Nanofocused X-Ray Beam to Reprogram Secure Circuits

Synchrotron-based X-ray nanobeams are investigated as a tool to perturb microcontroller circuits. An intense hard X-ray focused beam of a few tens of nanometers is used to target the flash, EEPROM and RAM memory of a circuit. The obtained results show that it is possible to corrupt a single transistor in a semi-permanent state. A simple heat treatment can remove the induced effect, thus making the corruption reversible. An attack on a code stored in flash demonstrates unambiguously that this new technique can be a threat to the security of integrated circuits.

[1]  Alessandro Paccagnella,et al.  Ionizing radiation effects on floating gates , 2004 .

[2]  T. Oldham,et al.  Total ionizing dose effects in MOS oxides and devices , 2003 .

[3]  Daniel M. Fleetwood,et al.  Field dependence of interface-trap buildup in polysilicon and metal gate MOS devices , 1990 .

[4]  A. Visconti,et al.  Total Ionizing Dose Effects in NOR and NAND Flash Memories , 2007, IEEE Transactions on Nuclear Science.

[5]  P. J. McNulty,et al.  Charge removal from FGMOS floating gates , 2002 .

[6]  F. J. Henley,et al.  Logic Failure Analysis of CMOS VLSI using a Laser Probe , 1984, 22nd International Reliability Physics Symposium.

[7]  D. Habing.  The Use of Lasers to Simulate Radiation-Induced Transients in Semiconductor Devices and Circuits , 1965 .

[8]  A. H. Johnston,et al.  Total ionizing dose effects on flash memories , 1998, 1998 IEEE Radiation Effects Data Workshop. NSREC 98. Workshop Record. Held in conjunction with IEEE Nuclear and Space Radiation Effects Conference (Cat. No.98TH8385).

[9]  Bruno Robisson,et al.  Local and Direct EM Injection of Power Into CMOS Integrated Circuits , 2011, 2011 Workshop on Fault Diagnosis and Tolerance in Cryptography.

[10]  A. Visconti,et al.  A model for TID effects on floating Gate Memory cells , 2004, IEEE Transactions on Nuclear Science.

[11]  David Naccache,et al.  The Sorcerer's Apprentice Guide to Fault Attacks , 2006, Proceedings of the IEEE.

[12]  Daniel J. Burns,et al.  Reliability/Design Assessment by Internal-Node Timing-Margin Analysis using Laser Photocurrent-Injection , 1984, 22nd International Reliability Physics Symposium.

[13]  Sylvain Bohic,et al.  ID16B: a hard X-ray nanoprobe beamline at the ESRF for nano-analysis , 2016, Journal of synchrotron radiation.

[14]  J.M. Caywood,et al.  Radiation-Induced Soft Errors and Floating Gate Memories , 1983, 21st International Reliability Physics Symposium.

[15]  Luca Crippa,et al.  Inside NAND Flash Memories , 2010 .

[16]  J.J. Wang,et al.  Total ionizing dose effects on flash-based field programmable gate array , 2004, IEEE Transactions on Nuclear Science.

[17]  S. Anceau,et al.  Electrical Modeling of the Effect of Photoelectric Laser Fault Injection On Bulk CMOS Design , 2013 .

[18]  Ross J. Anderson,et al.  Optical Fault Induction Attacks , 2002, CHES.

[19]  T. P. Ma,et al.  Ionizing radiation effects in MOS devices and circuits , 1989 .

[20]  T. A. Dellin,et al.  Radiation response of floating gate EEPROM memory cells , 1989 .

[21]  S. Gerardin,et al.  Radiation Effects in Flash Memories , 2013, IEEE Transactions on Nuclear Science.

[22]  Cécile Canovas,et al.  Fault Analysis and Evaluation of a True Random Number Generator Embedded in a Processor , 2013, J. Electron. Test..

[23]  Michael Hutter,et al.  Optical and EM Fault-Attacks on CRT-based RSA : Concrete Results , 2007 .

[24]  J.J. Wang,et al.  Biased-Irradiation Characteristics of the Floating Gate Switch in FPGA , 2006, 2006 IEEE Radiation Effects Data Workshop.

[25]  A. Scarpa,et al.  Charge loss after /sup 60/Co irradiation on flash arrays , 2003, Proceedings of the 7th European Conference on Radiation and Its Effects on Components and Systems, 2003. RADECS 2003..