Differences

This shows you the differences between two versions of the page.

--- backside:start [2018/02/20 21:24] – created mcmaster
+++ backside:start [2018/02/20 21:55] (current) – removed mcmaster
@@ Line 1: / Line 1: @@
-Backside analysis can include:
-  * Imaging transistor layout without delayering
-  * Imaging transistor activity using PMT, camera, etc for side channnel analysis
-  * Laser fault injection, bypassing security meshes and other things usually in the way
-Fabs often thin wafers and perform backside analysis to get at the transistors without going through metal.  [Functional IC Analysis] doesn't look like they thinned and they got pretty decent results.
-Sample preparation example: http://jiam.utk.edu/new/PDF/Allied-Backside-Thinning.pdf
-====== Camera ======
-===== Sample commercial unit =====
-With IR imaging and laser fault injection
-Camera:
-  * uEeye Cockpit
-  * ueye IDS camera
-  * U124xSE-NIR
-    * Or maybe: UI24xSE-NIR
-  * think its standard camera they removed IR filter
-  * https://en.ids-imaging.com/store/produkte/kameras/usb-2-0-kameras/ueye-se.html
-====== Optical fault injection ======
-In its simplest form, a CSP can be strobed with a camera flash
-You need to excite the silicon with a photo of wavelength no more than 1.1 um (reference: "1234.5eV⋅nm/1.1eV is about 1100 nm. Putting 1100 back into the denominator yields 1.1 eV" (link))
-[[Sergei paper|https://www.cl.cam.ac.uk/~sps32/ches2010-bumping.pdf]] references using 1065 nm laser. The paper shows using IR objectives. So maybe a broadband source would work okay too.
-[[https://www.riscure.com/uploads/2017/09/Practical-optical-fault-injection-on-secure-microcontrollers.pdf|Riscure paper]]
-Solutions include:
-  * [[http://www.alphanov.com/40-optoelectronics-systems-and-microscopy-single-spot-laser-station.html|Alphanov]]
-  * [[https://www.riscure.com/security-tools/inspector-fi/|Riscure Inspector FI]]
-  * ChipWispherer has voltage glitching. Could probably rig something similar up for optical glitching