Abstract This paper compares the three major semi-invasive optical approaches, Photon Emission (PE), Thermal Laser Stimulation (TLS) and Electro-Optical Frequency Mapping (EOFM) for contactless static random access memory (SRAM) content read-out on a commercial microcontroller. Advantages and disadvantages of these techniques are evaluated by applying those techniques on a 1 KB SRAM in an MSP430 microcontroller. It is demonstrated that successful read out depends strongly on the core voltage parameters for each technique. For PE, better SNR and shorter integration time are to be achieved by using the highest nominal core voltage. In TLS measurements, the core voltage needs to be externally applied via a current amplifier with a bias voltage slightly above nominal. EOFM can use nominal core voltages again; however, a modulation needs to be applied. The amplitude of the modulated supply voltage signal has a strong effect on the quality of the signal. Semi-invasive read out of the memory content is necessary in order to remotely understand the organization of memory, which finds applications in hardware and software security evaluation, reverse engineering, defect localization, failure analysis, chip testing and debugging.

Abstract The visible approach of optical Contactless Fault Isolation (VIS-CFI) serves the perspective of application in FinFET technologies of 10 nm nodes and smaller. A solid immersion lens (SIL) is mandatory to obtain a proper resolution. A VISCFI setup with SIL requires a global polishing process for sub-10 µm silicon thickness. This work is the first to combine all these necessary components for high resolution VIS-CFI in one successful experiment. We demonstrate Laser Voltage Imaging and Probing (LVI, LVP) on 16/14 nm technology devices and investigate a focus depth dependence of the LVI/LVP measurement in FinFETs.

Abstract Programmable logics, such as complex programmable logic devices (CPLDs) and field programmable gate arrays (FPGAs), are widely used in security applications. In these applications cryptographic ciphers, physically unclonable functions (PUFs) and other security primitives are implemented on such platforms. These security primitives can be the target of fault injection attacks. One of the most powerful examples of fault injection techniques is laser fault injection (LFI), which can induce permanent or transient faults into the configuration memories of programmable logic. However, localization of fault sensitive locations on the chip requires reverse-engineering of the utilized building blocks, and therefore, is a tedious task. In this work, we propose an automated technique using readily available IC debug tools to map and profile the fault sensitive locations of programmable logic devices in a short period.