Patent ID: 12235959

DETAILED DESCRIPTION OF VARIOUS EMBODIMENTS

This application is generally related to innovative countermeasures against optical probing. Various embodiments of the present disclosure now will be described more fully hereinafter with reference to the accompanying drawings, in which some, but not all embodiments of the disclosure are shown. Indeed, the disclosure may be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will satisfy applicable legal requirements. The term “or” is used herein in both the alternative and conjunctive sense, unless otherwise indicated. The terms “illustrative,” “example,” and “exemplary” are used to be examples with no indication of quality level. Like numbers refer to like elements throughout.

Overview

Modern Field Programmable Gate Arrays (FPGAs) and programmable System on Chips (SoCs) are used nowadays in different critical applications, e.g., aerospace, low-power computing devices. The sheer complexity in design, aggressive time-to-market has catalyzed the formulation of various IC debug and failure analysis (FA) techniques and tools. In the past two decades, due to increasing interconnect metal layers on the frontside of the ICs and new flip-chip packaging, FA analysis and defect localization through chip backside are becoming popular. The optical FA techniques, e.g., photon emission, laser-fault injection, optical probing, are based on silicon transparency towards near-infrared (NIR) photons. However, an adversary can also misuse the optical FA methods, e.g., optical probing, as a physical attack to expose the sensitive information, e.g., assets, accessible by the modern SoCs and FPGAs.

The two primary optical contactless probing techniques are electro-optical probing (EOP) and electro-optical frequency mapping (EOFM). While EOP can be used to probe electrical signals on the transistors directly, EOFM can be employed to create an activity map of active circuits. In both cases, the switching electric field in the transistors modulates the amplitude and phase photons reflected from active region of the device. In EOFM, a laser scans the region of interest on the device under test (DUT). The reflected light is fed into a spectrum analyzer, acting as a narrow band frequency filter to sample the signal for every scanned pixel. Then a PC is used to assemble the sampled frequency filter values into 2D image. In EOP measurement, an oscilloscope is used to average the collected electrical signal and synchronizes it with a trigger signal to create a time-domain waveform of the related voltage in the transistor.

Various embodiments of the disclosure generally relate to a method and system for hiding the state or stored bit in a logic gate and register. Instead of adding new manufacturing steps, the method is based on a standard logic cell, and is compatible with existing application-specific integrated circuit (ASIC) and FPGA design flow. In various embodiments, the conventional ASIC design flow can be used to identify security-critical circuits and one or more additional CMOS logic gate with selective input can be carefully placed to obscure the asset carrying gates activity. This additional logic gates is called “Concealing-Gate” in the disclosure.

Various embodiments of the disclosure use a careful selection of combinatorial and sequential logic gates, their inputs, and placement to camouflage the activity of the asset carrying logic elements. This approach will compel an adversary to focus on full-blown reverse engineering and extract the full functionality of IPs for each logic gates, hence, significantly increasing the time-cost of optical probing attack.

Instead of proposing a new standard cell, integration of new layers, or modification in packaging techniques, various embodiments of the disclosure can use the existing design ASIC flow.

Optical Contactless Probing

An attack approach using electro-optical techniques, e.g., EOP and EOFM, the source and analysis approach for electro-optical signal, and the features that influence successful EO signal extraction, are presented herein (e.g., referred to as optical contactless probing).

Attack Approach

During the physical attack, the ultimate goal of an adversary is to acquire the chip assets with minimum perturbing in the device. Therefore, the attacker may use the following steps to extract the target asset form the device.

Localizing the Point of Interest (PoI)

An adversary requires physical access to the device under attack (DUA) to extract the asset with optical probing. The adversary needs to identify a suitable combinatorial or sequential logic, which is termed as point-of-interest (PoI), for probing the asset. The adversary can identify the location of PoI using full-blown or partial reverse engineering. Without access to GDSII or netlist of the chip, automated delayering and imaging tool, invasive full-blown reverse engineering for functionality and connectivity extraction is an expensive, human labor intensive, and error-prone process. The objective of an unscrupulous entity, without access to GDSII, is fast asset extraction. Therefore, the adversary most likely to rely on a non-reverse engineering approach or partial reverse engineering. In a non-reverse/partial reverse engineering approach, an adversary can easily localize the non-volatile memory, cache, and ASIC, if the adversary has access to a laser scanning microscope (LSM), and/or photon emission microscope (PEM). Such a localization approach is faster and less expensive than a full-blown reverse engineering approach. This is most probably the most threatening attack scenario, where a single entity can rage a war against all the key-based security implementation of the device. For logic locking, the key-delivery unit can be optically probed to extract the locking key. Therefore, the adversary can localize the key-registers and key-gates using existing approaches.

Sample Preparation. The next step for attacking the PoI is preparing the sample. If the DUA is a non-flip chip, e.g., wire bond chip, the device can be optically probed by removing the package with acid etching or mechanical polishing. Unlike non-flip chip, a flip-chip can be optically probed without any further sample preparation, such as polishing, and anti-reflectant coating.

Optical Probing Measurement

The EO signal measurement approach during contactless probing is discussed herein. The optical probing measurement for either EOP and EOFM can be explained with the waveform shown inFIG.3. Two signals, sigaand sig are acting as input bit ‘1’ and bit ‘0’ to registers A and B, respectively. The reset signal is depicted with the waveform rst. sigastarts at the logic level low and then changes its state, as soon as the time needed for the preceding calculation (Tcalc) has elapsed. The rst signal resets the registers with a time period of Treset. As the time period for each consecutive power-on is constant, the time period for Tcalc is equal to the time period of Treset. Since sigaswitches at the frequency of reset signal, the registers (to be specific transistors) connected to sigaalso experience a change in the free carrier density and modulate the laser focused on the registers. Therefore, feeding the modulated signal to spectrum analyzer, a frequency domain 2D EOFM activity mapping can be generated. Similarly, feeding the modulated signal along with the rst signal to oscilloscope, instead of spectrum analyzer, a time domain waveform can be generated which is known as EOP signal. The rst signal acts as a reference signal for EOP analysis. Unlike siga, sigbdoes not change its status with reset signal, hence does not affect the outcome of EOP/EOFM measurement.

Influential Elements in Optical Probing

The elements that influence the optical probing evaluation and performance of the LSM during optical contactless probing are discussed herein.

Optical Resolution

Optical resolution is the minimum distance required to distinguish between two point-source through any optical system. According to Abbey's criterion, optical resolution, R, of any diffraction-limited microscope objective, which is also applicable for laser scanning microscope, is defined as,

R=λ2⁢NA(3)
where, NA is the numeric aperture of the objective lens. Lowering the wavelength of laser or increasing the NA can significantly improve the resolution of the optical probing.

As the semiconductor industry scale down the technology nodes, the distance between the transistors and logic gates also reduces. Since in EOFM analysis, 2D mapping of two different logic gates activity requires distinguishable edges between two logic gates/transistors, reaching the limit to optical resolution impact the EOFM measurement.

Laser Properties

Laser wavelength, spot size and intensity distribution play an important role in the optical probing analysis.

Laser Wavelength: The influence of the wavelength on the absorption coefficient is a major concern for the measurement. Laser with higher energy than silicon bandgap (λ<1.1 μm) generates photo carriers in the silicon devices. This effect is widely known as photoelectric laser stimulation (PLS), which is responsible for injecting unintentional faults in the device. Hence, 1.3 μm lasers are mostly used in most industry-standard LSM. However, smaller wavelength lasers promise better resolution for optical probing (see Eq. 3).

Laser Spot Size: The reflected laser response during EOFM/EOP measurement is influenced by all the transistors covered by the laser spot size. It is assumed, the laser intensity used for optical probing follows the Gaussian distribution function. The diameter of the laser is defined at the full width at half maximum of the intensity (FWHM) of the laser (seeFIG.4A) which is equal to the diameter of the Airy disk, Dairy,

Dairy=1.22λNA(4)

In confocal microscopy, the spread of the laser beam is further reduced by √{square root over (2)}. Therefore, the spot size of the probing signal is,

Dspot⁢size=1.22λ2⁢NA(5)

Table 1 presents the optical resolution determined from Eq. 3 and the laser spot size calculated from Eq. 5 for two different widely used lens—20X and 50X, in state-of-the-art LSM.

TABLE 1Optical Resolution and laser spot size for differentlaser wavelengths and lens used in LSM.NumericalOptical Resolution (nm)Laser Spot Size (nm)Apertureλ =λ =λ =λ =lens(NA)1300 nm1064 nm1300 nm1064 nm20x0.40162513302803229550x0.76/1855/650700/5321476/11211208/918

The reflected laser is modulated not only by the transistor or logic gate on which the laser is focused. The intensity of the reflected laser is a complex sum of intensity modulation caused by each logic gates under the laser spot. Hence, the EOFM and EOP measurements can significantly differ from the expected outcome. Therefore, the intensity of the reflected modulated photons can be represented in a simplified way,

Itotal=∑x=-Dspot⁢size/2Dspot⁢size/2Ix(6)

Where, Ixis the reflected modulated laser intensity. The intensity of the reflected laser is dependent on the node size, operating voltage, and device terminal, e.g., source/drain and gate, under laser spot. Such dependency of reflected laser modulation can be utilized to induce cross-talk during EOFM and EOP measurements. The intensity of the Itotal, to some extent, can be maintained constant for the RoI, by keeping the free-carrier density stable and total number of switching in logic gates/transistors fixed.

Position of Laser Beam on Device

One of the major challenges in the optical probing signal acquisition is low SNR. The probing signal is acquired multiple times by running the device in a reset loop to mitigate low SNR. The laser modulation depends on the laser beam position on the transistor, e.g., the drain, source, and gate region. The laser travels through different space charge region (SCR) depending on the area under the laser. For instance, inFIG.4B, if the laser is focused on the drain of the transistor, the photons get modulated at the SCR-diffusion interface. Unlike the drain region, focusing the laser on the gate terminal allows free carriers in the inversion channel and depletion region to modulate the reflected laser.

CMOS standard cell contains complementary NMOS and PMOS transistor. The logic state of the cell can be extracted by focusing the laser on either PMOS or NMOS. The output waveform in the EOP signal is inverted to each other. In EOFM analysis, both PMOS and NMOS will appear as active nodes, however, the intensity of NMOS is higher than the PMOS transistors.

Width of CMOS Gates

Continuous shrinking in technology node allows more transistors in the same area. Due to the bottleneck of optical resolution, the width and height of transistors in a chip have a significant influence on the end-result of EOFM and EOP measurement. For instance, the laser can be focused on a single logic gate for a larger technology node. However, the same laser spot may cover multiple logic gates in smaller technology nodes, hence, deviating from the ideal optical probing condition where the logic gates under laser spot only modulates the laser. Therefore, the area of the transistors and logic gates, e.g., the height and width of the logic gates, is crucial for any circuit based countermeasure. The width of the logic gate, Wlogic gate, can be defined as a multiplier of contact gate pitch (CGP) (also known as contact poly pitch (CPP) and simply gate pitch), and metal pitch, respectively. Therefore, the width of the logic gates can be defined as,
Wlogic gate=(n+1)×CGP(7)
where n is the number of poly gates in the logic cell.FIG.6represents the width of INVERTER and NAND gate, where n is 1 and 2, respectively. From Eq. 7 the width of the logic gates can be calculated for different technology nodes. The diffusion break width is 1×CGP for device implemented with double diffusion break (DDB) FinFET technology. In half-pitch, λhalfpitch, based design rule, the width of source drain is defined as 7λhalfpitchand the spacing between the two diffusion can be defined as 4 λhalfpitch.

During EO based attacks, the logic gate targeted for optical probing and neighbor logic gates under laser spot modulates the photons amplitude and phase. Therefore, the total logic gate width under laser spot facilitate in calculating the Itotalin Eq. 6. The total width, Wtotal width, of the logic gates under laser spot can be expressed as,

Wtotal⁢width=Wtarget⁢cell+∑i=1nKi×Wneighbour⁢celli+nWbreak(8)

Here, Wtarget cell, Wneighbour cell, and Wbreakrepresent the width of target cell for optical probing, neighbor cell, and diffusion break, respectively. The maximum of total logic gate width under laser stimulation, Wtotal width, is the diameter of the laser spot size. The width of the logic gates can be calculated from Eq. 7 and λhalfpitchbased design rules. Kiis the ratio of logic gate width covered by the laser spot and total width of the logic gate. The value of Kican be less than or equal to 1 for the logic gates at the edges of the laser spot.

Example Apparatus Architecture for Implementing Embodiments of the Present Disclosure

Attack Model

The threat model considered for the various embodiments of the disclosure is presented herein. The key-based security measures are impotent once an adversary has access to the key. In logic locking, during the boot-up process, the key-delivery unit read the key value from the key-storage and, through interconnects, fed the key in the key-delivery unit, e.g., the key-registers and key-gates. An adversary can use optical probing to extract the key from the key-delivery unit, e.g., the key-gates and key-registers. Though the interconnects carry key signals, interconnects' contribution to optical modulation is negligible. Consequently, the interconnects are considered secured against electro-optical attacks. The embodiments may assume an electrical probing protection mechanism is available in the DUA.

For a successful attack against key-protected security primitives, the following information is assumed to be available to the attacker. The adversary has access to an operational IC and knows the functionality of the chip. Second, the attacker has access to an optical probing system; such a system is available in any FA lab and can be rented for a couple of hundred dollars per hour. In addition to that, the attacker may need standard lab equipment, e.g., hotplate, logic analyzer, which are available in the market. It is assumed that the adversary is interested in partial/non-invasive reverse engineering to utilize the fast key localization approach.

Countermeasure

Selection of Concealing-Gate and Concealing-Input

CMOS is mostly used in logic gates to implement complex Boolean functions in digital implemented circuits. Depending on free carrier density in the transistors, the ON/OFF state of the MOS device can be determined. At static condition, all inputs are held at some valid logic level, e.g., input signal switching 0→0 and 1→1, and the circuit is not switching its state. At this state, CMOS logic consumes static power. The leakage current is the primary cause of static power consumption in the circuit. Consequently, the density of the free carrier in the MOS transistor does not change significantly. Therefore, the photons are not modulated by the transistor activity. On the other hand, CMOS logic gates consume dynamic power when the input switches, e.g., switching from 0→1 and 1→0, at a high frequency. Charging and discharging of load capacitance in a logic gate acts as the source of dynamic power consumption. The charging and discharging of load capacitance affects the free-carrier density in the MOS transistor, hence modulating the reflected laser. Therefore, irrespective of the change in the logic state, e.g., the output of the CMOS gate, transition in the input signal (0→1 transition and vice versa), modulates reflected photons. An adversary uses the modulated reflected laser to extract the time-domain and frequency-domain state of the logic gates.

Various embodiments of the disclosure can hide the switching activity of the logic elements, connected with the key carrying nets, from optical contactless probing. The logic gates and registers connected to the key nets are the target-logic gate and target-register for an adversary. The switching activity of the target-logic elements can be concealed by introducing additional logic gates as neighbor cells. These additional neighboring logic gates are termed as “CONCEALING-Gate” in this disclosure. The activity of the key-gates/registers can be camouflaged using the following two principles.

(1) EOFM Concealing: The EOFM activity of the target-logic gates are camouflaged if the concealing-logics/transistors and target-logics/transistors are placed at a shorter distance than optical lens resolution. Therefore, the absence of EOFM activity due to the static state of target-logics/transistors, e.g., 0→0 due to reset operation, can be camouflaged by inducing dynamic state, e.g., 1→0 due to reset operation, in concealing-logics/transistors.

(2) EOP Concealing: In a certain time-frame, the amplitude of the EOP waveform can be maintained at a constant value if the integrated reflected photon intensity remains constant within a tolerable limit. This can be achieved by inducing cross-talk in the EOP waveform by turning ON concealing-logics/transistors when the transistors of the target-logic are operating at static state.

The aforesaid principles can be fulfilled through the following conditions.

(1) EOFM Concealing:

(a) Frequency Matching: The nodes operating at the center frequency of the low-pass filter in the spectrum analyzer, only appear in the 2D mapping of EOFM signal. Therefore, concealing-logics' switching frequency must be the same as target-logics' switching frequency.(b) Switching Inputs: The transistors connected to the input signal, switching 1→0 during reset operation, only appear in the EOFM signal. Hence, concealing-logic must be at the dynamic state when the target-logic is operating at a static state. Note that in EOFM mapping, the activity of NMOS transistors is more prominent than the PMOS transistors' activity.(c) Distinguishable Edges: Extracting the logical state of a transistor/logic gate from an EOFM measurement requires an understanding of the shape and distinguishable edges of active nodes. In addition, EOFM measurement contains spatial information of an active node. Therefore, indiscernible EOFM activity edges of concealing and target-logic/transistor improve the camouflaging of the key-gate/register activity. An abrupt change in the shape of concealing- and target-logic/transistor is also undesirable, since the change may be detectable through image processing and computer vision.
(2) EOP Concealing:(a) Integrated Output: Transistors'/Logic gates' contribution to the EOP signal is dependent on the free carrier density in the device. Therefore, the ON/dynamic state of the concealing-gates/transistors can contribute to the EOP signal, when the target-gates/transistors operate at OFF/static state, hence, impede the EOP signal to change its state. Therefore, alternating ON/OFF state of concealing- and target-logics/transistors facilitate in maintaining a similar free-carrier density.(b) Reference Signal: the trigger signal provided to the oscilloscope act as a reference signal for the time-dependent EOP waveform generation.

FIG.7shows a block diagram of an example implementation of a concealing logic and a target logic, in accordance with one embodiment of the present invention. The block diagram of the example implementation comprises the target logic702and the concealing logic704. One or more input signals are coupled to the input of the target logic702, and complementary signals (or inverted signals) of the one or more input signals are coupled to the input of the concealing logic704. The block diagram of the example implementation may also comprise an evaluation circuit706. The target logic702and the concealing logic704can be coupled to the one or more input signals through the evaluation circuit706. In some embodiments, the evaluation circuit706can generate the complementary signals of the one or more input signals for the concealing logic704. The evaluation circuit706can also minimize the path delay between target and concealing gate input.

FIG.8shows an example gate-level implementation800of concealing logic and target logic for an inverter gate, in accordance with one embodiment of the present invention. The example gate-level implementation800comprises a target inverter gate802and a concealing inverter gate804. The example gate-level implementation800further comprises an evaluation circuit806, and the evaluation circuit806comprises a buffer808and an inverter810. An input signal x is coupled to the input of the target inverter gate802through the buffer808, and is coupled to the input of the concealing inverter gate804through the inverter810.

FIG.9shows an example gate-level implementation900of concealing logic and target logic for a NAND gate, in accordance with one embodiment of the present invention. The example gate-level implementation900comprises a target NAND gate902and a concealing NOR gate904. The example gate-level implementation900further comprises an evaluation circuit906, and the evaluation circuit906comprises two buffers908,910, and two inverters912,914. Two input signals x and y are coupled to the two inputs of the target NAND gate902through the buffers908and910respectively, and are coupled to the two inputs of the concealing NOR gate904through the inverters912and914respectively.

In complementary metal-oxide-semiconductor (CMOS), the dynamic power is consumed during the switching of inputs, e.g., 1→0 transition and vice versa. The photons are modulated by the free-carrier density in the transistors connected to switching input. In optical probing, the signal generated from the modulated photons is used to extract the time-domain (e.g., EOP) and frequency-domain (e.g., EOFM) state of the logic gates. In various embodiments of the present invention, such as those inFIGS.7-9, the objective of the concealing logic gate is to camouflage the switching activity in the target logic gate.

The concealing gate can be a standard logic gate. The nature of the concealing gate, e.g., Inverter, NAND, NOR, can be defined based on design resources, e.g., area, power and delay. For a logic function, ƒ(x, y, z), the concealing gate can be defined byƒ(Cx, Cy, Cz). Stated otherwise, the concealing gate's input can be the complement of the input of the logic function (or the target gate), and the corresponding output of the concealing gate can be the complement of the output of the logic function (or the target gate).

Table 2 illustrates the optical probing results of an example embodiment of the present invention for different switching of an input or output signal. As shown in Table 2, the logic gates, either target or concealing logics are switching during optical probing, hence, expected to appear as active node in EOFM measurement. Similarly, the combined activity of the proposed approach is expected to generate an EOP signal with a fixed value. Therefore, optical probing signal cannot be interpreted without a complete understanding of the gate-level implementation of the netlist.

TABLE 2Optical probing results of a target andconcealing gate for different input switchingOpticalOptical probingCombined Opticalprobing signalsignal forprobing of Targetfor TargetConcealingand Concealing gateInput/OutputLogicLogicunder laser spotSwitching forEOFMEOPEOFMEOPEOFMEOPTarget LogicActivityOutputActivityOutputActivityOutput0→0No0Yes1Yes10→1Yes3No0Yes11→0Yes0No1Yes11→1No1Yes0Yes1

The free carrier density of a logic gate varies with the transistors' switching activity. It is a well-known fact that the MOSFET current is a function of the inversion charge density. The charge density of two adjacent identical transistors, e.g., transistors with same width and length, operating at the matching drain/source/gate voltage can be considered identical. Therefore, between two transistors, total free carrier density can be maintained similar, if the poly-gate input voltage of the two transistors is inverted.

This can be explained by an example implementation1000for concealing NAND gate activity presented inFIGS.10A,10B. InFIG.10A, the example implementation1000comprises a NAND gate1002and two inverter gates1004,1006. The NAND gate1002and the inverter gates1004,1006are assumed to be target-gate and concealing-gates, respectively. The input of the NAND gate1002is coupled to inputs A and B (also called target input signals herein). The inputs of the inverter gates1004and1006are coupled to the complements of the inputs A and B (or the inverted target input signals) respectively. In the example implementation1000, the inverter gates1004,1006are concealing gates for inputs A and B respectively. The operation of the concealing gate1004for input A is used as an example to illustrate how the switching activity of the corresponding NMOS transistor in the target NAND gate is camouflaged herein. The concealing gate1006camouflages the input B signal switching in a similar manner. For input A=1, e.g. input A is at a logic high level, the NMOS, NT1, of the NAND gate1002is turned ON (or operates in the saturation region), whereas the NMOS, NC1, of the inverter1004operates in the cutoff region. For input A=0, e.g. input A is at a logic low level, the NMOS, NT1, of the NAND gate1002operates at the cutoff region, whereas the NMOS, NC1, of the inverter1004is turned ON. Therefore, the total free carriers on the area of the two NMOS transistors, NT1and NC1, can be considered constant within a tolerable limit when the two transistors have the same width and length. Applying the inverted target input signal to concealing-logic/transistor allows the transistors mentioned above to operate at the same switching frequency. In addition, one of the transistors must appear as an active node in the EOFM 2D mapping since at least one of the transistors must switch from 1→0 during reset operation. Hence, the “frequency matching” and “switching inputs” conditions for EOFM concealing are fulfilled. Due to similar reason, either concealing-gate or target-gate act as the source of modulation of reflected photons and contribute to integrated EOP signal. Consequently, the EOP signal can be interpreted as “1” when compared with the reference signal. A security designer can choose INVERTER, NAND/NOR gate, to conceal the target-logic activity.

Concealing-Gate Placement in Layout

To mask the EOFM activity of the target-gate, the edges between the concealing- and target-logic/transistor need to be indistinguishable. Therefore, the concealing- and target-gates need to be placed at a distance less than the optical resolution considered during the IC security design. It has already been proved that photons modulated at the drain terminal contribute the most in EOFM/EOP measurement. Hence, in the device layout, the drain terminals of the concealing-transistors must be placed at the minimum distance from the corresponding target transistors (See WmininFIG.11AandFIG.11B). The activity of the asset carrying transistors can be camouflaged by maintaining the distance, Wmin, between the drain edge of the concealing-gate and the furthest edge of the asset carrying transistor lower than the optical resolution, e.g., Wmin≤R. Though, this is a condition for hiding the target-gate activity, but not the sufficient one. An adversary may apply different input patterns to identify the edge of the EOFM activity of the concealing- and target-gate. The edges of EOFM activity of two transistors operating at opposite phase change can be resolved, though the gates are placed at a distance lower than optical resolution. The edges of EOFM activity become obscure if the adjacent transistors, placed at optical resolution distance, are switching in the same direction, e.g., 1→0 and vice versa. The distance between the two same direction phase changing transistors is defined as WED(SeeFIG.11AandFIG.11B). For example, inFIG.10A, the NC1and NT2transistors change phase in the same direction, e.g., 1→0, when reset is pressed. According toFIGS.11A and11B, the distance between these two transistors is defined as W1. Therefore, the transistors' edges in the EOFM activity is not distinguishable, if the distance between the two transistors, is less than the optical resolution, e.g., W1≤R. The worst-case scenario is, transistors NC1and NT2are changing phases in the opposite direction (seeFIG.10B). However, the target-logic's activity remains hidden if the distance between NC1and NC2transistors, W2inFIGS.11A and11B, is less than optical resolution.

Security Evaluation of Presented Countermeasure

To evaluate the optical probing resiliency of the method disclosed herein, a security metric is developed that is based on the two crucial parameters for optical contactless probing-(a) Optical resolution of the LSM, (b) Spot size of the laser source.

EOFM Differentiability Metric. An adversary can probe a logic gate, if edge differentiability metric, ƒ(ED), for an optical probing system is larger than “1”.

f⁡(ED)=WEDR(9)

Lower the value of ƒ(ED) indicates higher complexity in EOFM analysis. WEDis the interspacing between two adjacent nearest edges of transistors switching at the same phase change direction.

In NAND gate inFIGS.11A,11B, the input signal is assumed to be the key-bit signal. The minimum WEDis achieved when the concealing-gate input, Ā and NAND gate input, B change phase at same direction. The maximum distance appears when the concealing-gates, A andB, switching direction is the same. Table 3 summarizes the WEDfor different inputs switching scenarios. The diffusion break is assumed to be equal to CGP. The EOFM measurement complexity metric for NAND/NOR gate has been calculated for different node technology and presented in Table 4. As seen in Table 4, it is evident that logic gates fabricated at a technology node lower than 45 nm can be concealed effectively.

EOP Cross-talk Metric. In the presented countermeasure, the concealing-gates are the neighbor cells for the target-cell. Therefore, if the Wtotal widthcalculated from Eq. 8, is smaller than laser spot size, Dspot size, the concealing-gate will contribute to the EOP signal while the target-transistors are either turned OFF or static state. The cross-talk induced in an EOP signal is proportional to the total transistor width covered by the laser spot size. The calculated Wtotal widthmust include the drain regions of concealing-gates, see the distance WCTshown inFIG.11A. Hence, the EOFM measurement complexity metric in terms of induced cross-talk is,

f⁡(CT)=wCTDspot⁢size(10)

Table 5 shows the security metric evaluation for different technology nodes. It is evident from the analysis that concealing-gates can be used to protect the target-gates implemented in 45 nm or smaller technology nodes.

TABLE 3The WEDfor A signal concealing-gate for different Logic gates/transistors depending on their phase change direction.Phase ChangeDistance with the concealing-Input SignalAfter ResetGate in terms of CGP*concealing-Gate Signal, A1 → 0—*Key-gate Input Signal1 → 0No EOFM activity(Key Value), AKey-gate Input Signal,B1 → 03 × CGP (W1in FIG.11a)(Two possible inputs)4 × CGP (W1in FIG.11b)0 → 0No EOFM activityconcealing-Cate Signal,B0 → 0No EOFM activity(Two possible inputs)1 → 05 × CGP (W1in FIG.11a)7 × CGP (W1in FIG.11b)*= it is assumed that A is the key bit signal. Therefore all distance is presented in terms of concealing-gate for signal A..

TABLE 4EOFM edge differentiability metric calculated for different nodetechnology for concealing-INVERTER gate and Target NAND gate.Tech-WED=WED=nologyW1=f(ED)f(ED)W =f(ED)f(ED)NodeCGP3 ×for λ =for λ =5 ×for λ =for λ =(nm)(nm)CGP1300 nm1064 nmCGP1300 nm1064 nm902607800.911.1113001.51.9652206600.780.9411001.31.6451604800.560.698000.941.14321123600.420.516000.700.8622902700.310.394500.530.6414702100.240.33500.410.5

TABLE 5EOP cross-talk metric calculated for different node technology.NAND asTech-INVERTERf(CT)concealing-f(CT)nologyas concealing-λ =λ =gate, WCT=λ =λ =NodeCGPGate, WCT=130010649 × CGP13001064(nm)(nm)7 × CGP (nm)mmnm(nm)nmnm9026018201.231.5023401.581.936522015401.041.2719801.341.634516011200.750.9214400.971.19321127840.530.6410080.680.8322906300.420.528100.540.6714704900.330.406300.420.52
Countermeasure for Latch and Flip-flop

The countermeasure disclosure herein is equally applicable in hiding the asset information stored in the flip-flop. The sequential logic elements can be protected by two different approaches. First, each combinatorial logic used to design target-flip-flop must be protected with a concealing-gate connected to the inverted input of that combinatorial logic. Second, a security designer can use concealing-flip-flop to protect the target-flip-flop. In the later approach, the logic gates used as building block for the concealing-flip-flop must be placed next to its corresponding target-flip-flop building block logic gates in the layout. Hence, no additional standard cell design is required.

Target-gate Selection

Adding a concealing-gate for each of the target-logic increases the area and power overhead. Besides, random insertion of concealing-gates does not offer any improvement in security against optical probing. In logic locking, embodiments of the invention can select key-gates/registers to protect using the concealing-gate. Note that, in more general scenarios, a security designer can identify the key carrying net and corresponding target-logic gate/registers in a more systematic manner using the developed target-gate selection metric.

Validation of Presented Countermeasure

In this disclosure, the concealing-logic gate based logic gate activity camouflaging approach is evaluated through simulated EOP waveform generation.

Fundamentals of Simulated EOP Waveform Generation

The reflected photon modulation capacity of devices, such as free carrier absorption, is linearly related to the voltage at the MOSFET terminals. The modulation capacity of each terminal of the transistor can be calculated from the area of each terminal and piece-wise voltage changes. For simplicity, it is assumed that over the entire width or area of a MOSFET terminal, the voltage only varies with time, e.g., each transistor terminal acts as an equipotential surface. The modulation capacity of the terminal can be defined as,
Mi=ki×Wi×Δvi(11)
where, kiis a relative modulation constant, which depends on the type of transistor, e.g., PMOS or NMOS, terminals of the transistor under consideration. The value of kican be defined empirically or based on the BSIM-CMG model. In the analysis herein, only the pull-up network of the logic gates is considered. In PMOS transistors, the source/drain contribution is 1.5 times stronger than the gate terminal. Wiand viare the width of the terminal and temporal voltage changes on that terminal. The amplitude of EOP signal amplitude, Rr is,

RT=∑i=1Wtotal⁢widthPi×Mi(12)
EOP Signal

The effectiveness of concealing-gates in hiding the target-logic elements activity is evaluated against both EOP and EOFM analysis. There are two scenarios where an adversary may attempt while probing the target-gates:(1) Scenario-1: Focusing the laser spot on the target-gate, hence, photons modulated by the concealing- and target-gates are collected by the photo-detector (seeFIG.12A).(2) Scenario-2: The target-gate is placed at one end of the laser spot to reduce the cross-talk from the concealing-gates (seeFIG.12B).

Both of the scenarios are evaluated using the NAND gate as an example target/asset-carrying logic gate. In one embodiment of the invention, INVERTERs are used as concealing-logic gates due to low power and area overhead. Note that a security designer can choose any logic gate as a concealing-gate to hide the functionality of the target-logic element, as long as the inputs of the concealing-gates are Inverted. The EOP signal is generated using Eq. 11 and Eq. 12. The gates are implemented in 32 nm technology nodes. The total width of the logic gates can be defined by Eq. 7 and Eq. 8. It is assumed that the laser is focused on PMOS transistors.

The input to the target-NAND gates, and concealing-gates and the NAND cell output, Z, is presented inFIG.13A. The simulated optical probing signal of a NAND gate without and with concealing-gates, for scenario-1, are showed inFIG.13B. Though the EOP measurement of the NAND gate without concealing-gate follows similar behavior collected empirically, EOP measurement with concealing-gates reads a higher value than the prior one for certain input combinations. The cross-talk introduced by the concealing-gate forced the EOP signal of the NAND gate to maintain optical probing output as logic “1”. Therefore, the switching activity of the target-gate is camouflaged by the concealing-INVERTER gates. Similarly, in scenario-2, the EOP signal with concealing-gates maintain a higher value when the NAND gate output is switched to “0”. It is important to note that placing the target-gate at one end of the laser spot, e.g., creating the scenario-2 in real life implementation, requires an in-depth understanding of the laser property, precise control over the stage movement, and higher optical resolution. Therefore, the “Concealing-Gate” approach is effective against an adversary without extensive reverse-engineering capability.

Modulation Capability of the Logic Gates

EOFM analysis represents the reflected photons got modulated by transistors operating at a certain frequency. Therefore, the modulation capacity, defined by the Eq. 11 is linearly related to the modulation properties of the reflected photons. Therefore, variation in modulation capacity along the width of logic cells represent the possible EOFM activity source along with its spatial location. However, the modulation capacity cannot be used as a representation of original EOFM or simulated EOFM activity since it does not consider complex photon-material interactions and laser properties. The modulation capability of the PMOS transistors for the scenario-1 (seeFIG.12A) is evaluated, where the activity of the target-NAND gates are disguised with concealing-INVERTER gates. The distance between probable EOFM activity edges, e.g., the w1and w2, is extracted.FIG.14represents the spatial changes in modulation capability along the logic gates width. It has been identified, the w1and w2are 240 nm and 576 nm for the input sets, {A, B}={0, 1}, {1, 0} and {A, B}={1, 1}, respectively. According to Table 1, either w1and w2are less than the optical resolution of 1300 nm and 1064 nm laser. Besides, the phase change direction of concealing-input signal and the target-NAND gate inputs are the same, which emphasizes the difficulty in identifying edges of concealing- and target-NAND gate transistors. However, analyzing the modulation capacity for different input signals inFIG.14, asymmetric footprint in EOFM 2D mapping can be predicted. A security designer can eliminate the asymmetric in EOFM activity shape by using 2-input logic gates, e.g., NAND/NOR gates, to hide logic gates activity (seeFIG.15).

Experimental Validation

Device Under Test (DUT)

The attack resiliency of some embodiment of the invention against optical probing is evaluated in a FPGA platform. The embodiments use an example Flash-based Microsemi MPF300 Polarfire FPGA manufactured with 28 nm technology in a flip-chip BGA package. The FPGA is implemented in an Avalanche FPGA development board. There is no heat sink on top of the package, and hence, there is direct access to the silicon substrate on the backside of the chip without any package preparation or silicon polishing. According to the measurements, the thickness of the substrate is about 700 μm. An 1.3 μm light source is used for acquiring the image of the die without any substrate thinning.FIG.16Apresents the FPGA logic fabric consists of several identical configurable logic blocks (CLBs). The FPGA logic resources are fabricated as logic clusters, as presented in the orange rectangular box inFIG.16A. The interfacing circuit responsible for the routing between CLBs of the FPGA, is shown in the red rectangle inFIG.16A. Each cluster consists of twelve logic elements. Each logic element consists of a 4-input LUT with a D-flip-flop. The logic element is fracturable, which means the LUT and flip-flop can be used either together or independently.

Measurement Setup

A Hamamatsu PHEMOS-1000 LSM used for FA is used to perform EOFM analysis over the DUT. The equipment consists of a suitable probing light source (Hamamatsu C13193), and an optical probing preamplifier (Hamamatsu C12323). The development board is placed inside the PHEMOS and a PC is connected to the board to program the FPGA. Programming of the FPGA is performed through USB which is handled by an FTDI chip and powered by the development board supply. A 50×/0.76 NA lens is used to generate the 2D mapping of the EOFM activity of the circuit.

Proof-of-Concept Circuit Implementation

For the experiment, an example Proof-of-concept (PoC) circuit is implemented in the DUT. The target-NAND gates, in the PoC circuit (seeFIG.16B), are connected to input A and Key-input, Key. Each target-gate is implemented with a single concealing-gate. The concealing-gates are connected to the inverted signal of the key-input and signal A. The inputs in the PoC circuit are fed through flip-flops. Four of the PoC concealing-gate circuit are implemented in the FPGA and the EOFM activity is measured with and without concealing-INVERTER and NAND gates.

Experimental Results

The concealing-gates are considered successfully camouflaged if the following properties are fulfilled:(1) the target-gate activity in the EOFM activity is always present. This satisfies the frequency matching and switching inputs property of EOFM concealing.(2) the EOFM activity edges of concealing- and target-logic gates are indistinguishable, irrespective to the input pattern applied to the device. This satisfies the distinguishable edges property of the EOFM concealing.

To probe the keys from key-registers and target-logic gates, three input vectors are compared, x0, x1, andx1where the inputs for x0, x1, andx1are 0000, 1100, and 0011. Since the chip does not perform any functions during the boot-up process, it can be assumed that all the input ports are set to an inactive or grounded state. Hence, the input vector x0can be a representation of the boot-up condition of the chip.

An adversary can identify the area containing the sequential and combinatorial logic gates by analyzing the EOFM activity of clock signal, as shown inFIG.17A. The green and yellow rectangles1702,1704represent the locations of input register and key-register, respectively, and both are implemented with concealing registers. The blue and orange rectangles1706,1708represent the locations of a target gate with concealing NAND gate, and a target gate with concealing inverter gate, respectively. The EOFM measurement of target-logic elements with concealing-gates, shown inFIG.17BandFIG.17C, are measured for the same key value with input signals x0and x1, respectively.FIG.17Dcontains the inverted key compared to the aforementioned figures with input signalx1. Since, either target- or concealing-logic elements is active for different inputs (seeFIG.17A,17B,17C,17D), the logical state of the target-gate cannot be predicted without the knowledge of gate-level netlist, which can be extracted with only full-blown reverse engineering. In addition, inverting the inputs does not induce significant change in EOFM activity which can be interpreted with human eyes (seeFIG.17CandFIG.17D). Unlike PoC implemented with concealing-gates, the activity of the key-registers and key-gates can be exposed from the EOFM activity (seeFIG.18AandFIG.18B). InFIGS.18A,18B, the green, yellow, and red rectangles1802,1804,1806,1808represent locations of input register, key-register, and two target NAND logic gates, respectively. The key value extracted from the EOFM activity is “0101”.

Resiliency Against Image Processing and Computer Vision Analysis

An adversary may attempt to distinguish the activity of the key-gates/registers from concealing-gates in EOFM measurement, using image processing and computer vision techniques. An adversary can collect multiple EOFM measurements for different input patterns and use image processing to extract the key value. To evaluate the performance of the concealing-gate, one embodiment of the invention implements a flip-flop protected with a concealing-flip-flop (see orange rectangle inFIG.19AandFIG.19B) and compared the EOFM activity with the exposed target-flip-flop (see white rectangle inFIG.19AandFIG.19B). A 50×/0.76 NA lens is used with additional2X zoom to evaluate the attack resiliency for the embodiment. It is evident that due to the presence of concealing-gates, the optical probed data form EOFM activity is “1”, irrespective to the data stored in target-flip-flop. The registered images of theFIG.19AandFIG.19Bare shown inFIG.19C, which shows negligible spatial shift due to change in input signal to protected target-flip-flop.

Optical Resolution and Laser Spot Size

It is mostly argued that optical probing is reaching its limit due to low optical resolution. However, in reality, an adversary attempts to probe the entire logic gate, register or cache memory cells. The optical resolution can be further increased once the adversary has access to a solid immersion lens (SIL). SIL can improve the NA by the refractive index times of the SIL material. Table 6 presents the resolution and laser spot size with SIL. The challenge of making use of SIL is that the DUT must be polished down to 10-30 μm. Though there has been a significant advancement in automated backside polishing, the process still require higher processing time. Besides, in the flip-chip ball grid (BGA) packages, the BGA leaves shadow marking due to higher pressure applied during bulk silicon polishing. In addition, the effort significantly increases if the chip is implemented in a PCB.

Table 6. Optical resolution and laser spot diameter for different wavelength laser and lens.

Wavelength +ResolutionDiameterLensNA(nm)(nm)1300 nm + 50x lens*0.7685514761064 nm + 50x lens*0.7670012081300 nm + SIL**3.5185453650 nm + SIL**3.495.6233*= 50X is objective lens used in optical attacks.**= SIL stands for solid immersion lens.
Attack Resiliency

The success of the method and system disclosed herein depends on increasing time-cost of standard cell identification and full-blown reverse engineering. An adversary can read the logical state of any combinatorial or sequential gate if the adversary can extract the gate-level netlist of the device. A reverse engineer's task can be made difficult by implementing physical layout obfuscation techniques like camouflage cells, covert gate, dummy vias, filler cells, etc. in the chip. In addition, only extracting the standard cell library is not enough to identify the functionality of the target-cells along with the concealing-gate. Moreover, recently proposed covert gate based physical layout obfuscation method can protect the logic gate detection from imaging tools and functional analysis. Since understanding the input signal to each logic element and identifying the implemented logic gates can only facilitate interpreting the optical probing signal, implementing concealing-gates with covert gates-based layout obfuscation will make an SoC bulletproof against optical probing attack. Therefore, an attempt to bypass the necessity of full-blown reverse engineering by recognizing the standard cell library using active layer and via detection is futile.

CONCLUSION

Various embodiments of the disclosure represent a design methodology to implement a contactless optical probing resistance design. This technique uses standard cell library to prepare a circuit based countermeasure against chip backside attacks. The method can be readily applied to both ASIC and FPGA design flow. A security metric is developed to evaluate the optical attack resiliency of the device. A simulation-based study validates the efficacy of the countermeasure. Experimental results have also demonstrated that the presented countermeasure is an effective technique to protect the chip activity from chip backside optical attacks. Since this technique is based on the equal number of switching in the asset carrying modules, the protection mechanism can be extended to protect device secrets form side-channel analysis.

While the embodiments are susceptible to various modifications and alternative forms, specific examples thereof have been shown in the drawings and are herein described in detail. It should be understood, however, that these embodiments are not to be limited to the particular form disclosed, but to the contrary, these embodiments are to cover all modifications, equivalents, and alternatives falling within the spirit of the disclosure. Furthermore, any features, functions, steps, or elements of the embodiments may be recited in or added to the claims, as well as negative limitations that define the inventive scope of the claims by features, functions, steps, or elements that are not within that scope.