In this paper, we discuss a set of techniques and analysis methodologies for the reverse engineering and functionality extraction of complex mixed-signal ICs with a special focus for security applications. Front and back side reflected light pattern images at different magnifications are used to identify circuit blocks. Time-integrated and time-resolved photon emission data is used to identify gate logic states, sequences of events, and specific functional activity. Backscattered electron and scanning transmission electron images mosaics are used to reverse engineer individual gates and observe local interconnects. Thermal imaging is used to aid in the functional block identification and analog gates analysis. Different advanced methodologies for tool automation, focusing, mapping, and image processing are also discussed in the context of our proposed electro-optical tester based technique.

This work presents a new photon emission microscopy camera prototype for the acquisition of intrinsic light emitted from VLSI circuits during their normal operation. This novel camera was designed to be sensitive to longer wavelengths in order to maximize the signal intensities from modern VLSI chips which are characterized by a red shift in the intrinsic emission spectrum. In this paper, we will characterize the performance of the camera using 32 nm and 22 nm SOI chips. The novel camera is able to collect emission images with the circuit under test operating at a supply voltage down to 0.5 V, exceeding the performance of a state-of-the-art InGaAs camera.

This work presents a comparison of two generations of Superconducting nanowire Single-Photon Detector (SnSPD) prototypes used for Time-Resolved Emission (TRE) measurements from VLSI chips. The performance of the systems is compared in order to understand the figures of merit that a single-photon detector should have to enable the acquisition of time resolved emission waveforms for ultra-low voltage applications. We will show that measurements down to a new World record low 0.4 V supply voltage were made possible by a careful optimization of the detector front-end electronics. We also characterized the emission from devices with different threshold voltages in order to understand how the emission contributions depend on this parameter and how this affects the resulting waveform SNR.

The light emission from ever increasing OFF-state leakage currents in advanced CMOS technologies can now be reliably measured using existing photon detectors. The measurements of such an emission provide valuable information about the operation of ICs. In this paper we suggest and experimentally confirm two new techniques based on such measurements - Transient Logic State Detection and Power Supply Noise Analysis.