IC camouflaging has been proposed as a promising countermeasure against reverse engineering. Camouflaged gates contain multiple functional device structures, but appear as a single layout under microscope imaging, thereby concealing circuit functionality. The recent covert gate camouflaging design comes with a significantly reduced overhead cost, allowing numerous camouflaged gates in circuits which improves resiliency against invasive and semi-invasive attacks. Dummy inputs are used in the design, but SEM imaging analysis has only been performed on simplified contact structures so far. In this study, we fabricated real and dummy contacts in different structures and performed a systematic SEM analysis to investigate contact charging and passive voltage contrast. Machine learning based pattern recognition was also employed to examine the possibility of differentiating real and dummy contacts. Based on our experimental results, we found that the difference between real and dummy contacts is insignificant, which effectively prevents SEM-based reverse engineering.

In the hardware assurance community, Reverse Engineering (RE) is considered a key tool and asset in ensuring the security and reliability of Integrated Circuits (IC). However, with the introduction of advanced node technologies, the application of RE to ICs is turning into a daunting task. This is amplified by the challenges introduced by the imaging modalities such as the Scanning Electron Microscope (SEM) used in acquiring images of ICs. One such challenge is the lack of understanding of the influence of noise in the imaging modality along with its detrimental effect on the quality of images and the overall time frame required for imaging the IC. In this paper, we characterize some aspects of the noise in the image along with its primary source. Furthermore, we use this understanding to propose a novel texture-based segmentation algorithm for SEM images called LASRE. The proposed approach is unsupervised, model-free, robust to the presence of noise and can be applied to all layers of the IC with consistent results. Finally, the results from a comparison study is reported, and the issues associated with the approach are discussed in detail. The approach consistently achieved over 86% accuracy in segmenting various layers in the IC.

Reverse engineering (RE) is the only foolproof method of establishing trust and assurance in hardware. This is especially important in today's climate, where new threats are arising daily. A Printed Circuit Board (PCB) serves at the heart of virtually all electronic systems and, for that reason, a precious target amongst attackers. Therefore, it is increasingly necessary to validate and verify these hardware boards both accurately and efficiently. When discussing PCBs, the current state-of-the-art is non-destructive RE through X-ray Computed Tomography (CT); however, it remains a predominantly manual process. Our work in this paper aims at paving the way for future developments in the automation of PCB RE by presenting automatic detection of vias, a key component to every PCB design. We provide a via detection framework that utilizes the Hough circle transform for the initial detection, and is followed by an iterative false removal process developed specifically for detecting vias. We discuss the challenges of detecting vias, our proposed solution, and lastly, evaluate our methodology not only from an accuracy perspective but the insights gained through iteratively removing false-positive circles as well. We also compare our proposed methodology to an off-the-shelf implementation with minimal adjustments of Mask R-CNN; a fast object detection algorithm that, although is not optimized for our application, is a reasonable deep learning model to measure our work against. The Mask R-CNN we utilize is a network pretrained on MS COCO followed by fine tuning/training on prepared PCB via images. Finally, we evaluate our results on two datasets, one PCB designed in house and another commercial PCB, and achieve peak results of 0.886, 0.936, 0.973, for intersection over union (IoU), Dice Coefficient, and Structural Similarity Index. These results vastly outperform our tuned implementation of Mask R-CNN.

Reverse engineering today is supported by several tools, such as ICWorks, that assist in the processing and extraction of logic elements from high definition layer by layer images of integrated circuits. To the best of our knowledge, they all work under the assumption that the standard cell library used in the design process of the integrated circuit is available. However, in situations where reverse engineering is done on commercial off-the-shelf components, this information is not available thereby, rendering the assumption invalid. Until now, this problem has not been addressed. In this paper, we introduce a novel approach for the extraction of standard cell library using the contact layer from these images. The approach is completely automated and does not require any prior knowledge on the construction or layout of the target semiconductor integrated circuit. The performance of the approach is evaluated on two AES designs with 10,000 cells compiled from standard libraries with 32nm and 90nm node technologies having 350 and 340 standard cells respectively. We were able to successfully extract 94% and 60% of the standard cells from the 32nm and 90nm AES designs using the proposed approach. We also perform a case study using a realworld sample extracted from a smartcard. Finally, we also investigate the various challenges involved in the extraction of standard cells from images and the steps involved in resolving them.

Counterfeit electronics constitute a fast-growing threat to global supply chains as well as national security. With rapid globalization, the supply chain is growing more and more complex with components coming from a diverse set of suppliers. Counterfeiters are taking advantage of this complexity and replacing original parts with fake ones. Moreover, counterfeit integrated circuits (ICs) may contain circuit modifications that cause security breaches. Out of all types of counterfeit ICs, recycled and remarked ICs are the most common. Over the past few years, a plethora of counterfeit IC detection methods have been created; however, most of these methods are manual and require highly-skilled subject matter experts (SME). In this paper, an automated bent and corroded pin detection methodology using image processing is proposed to identify recycled ICs. Here, depth map of images acquired using an optical microscope are used to detect bent pins, and segmented side view pin images are used to detect corroded pins.

Optical probing from the backside of an integrated circuit (IC) is a powerful failure analysis technique but raises serious security concerns when in the hands of attackers. For instance, attacks using laser voltage probing (LVP) allow direct reading of sensitive information being stored and/or processed in the IC. Although a few sensor-based countermeasures against backside optical probing attacks have been proposed, the overheads (fabrication cost and/or area) are considerable. In this paper, we introduce nanopyramid structures that mitigate optical probing attacks by scrambling the measurements reflected by a laser pulse. Nanopyramid structure is applied to selected areas inside an IC that requires protection against optical probing attacks. The fabrication of nanopyramids is CMOS compatible and well established for photovoltaic applications. We design the nanopyramid structure in ICs, develop the LVP attacking model, and perform optical simulations to analyze the impact of nanopyramids on LVP. According to the simulation results, the nanopyramid can disturb the optical measurements enough to make LVP attacks practically infeasible. In addition, our nanopyramid countermeasure has no area overheads and works in a passive mode without consuming any energy.

This paper discusses the development of an extensible programmatic workflow that leverages evolving technologies in 2D/3D imaging, distributed instrument control, image processing, and automated mechanical/chemical deprocessing technology. Initial studies involve automated backside mechanical ultra-thinning of 65nm node IC processor chips in combination with SEM imaging and X-ray tomography. Areas as large as 800μm x 800μm were deprocessed using gas-assisted plasma FIB delayering. Ongoing work involves enhancing the workflow with “intelligent automation” by bridging FIB-SEM instrument control and near real-time data analysis to establish a computationally guided microscopy suite.

Reverse engineering of electronic hardware has been performed for decades for two broad purposes: (1) honest and legal means for failure analysis and trust verification; and (2) dishonest and illegal means of cloning, counterfeiting, and development of attacks on hardware to gain competitive edge in a market. Destructive methods have been typically considered most effective to reverse engineer Printed Circuit Boards (PCBs) – a platform used in nearly all electronic systems to mechanically support and electrically connect all hardware components. However, the advent of advanced characterization and imaging tools such as X-ray tomography has shifted the reverse engineering of electronics toward non-destructive methods. These methods considerably lower the associated time and cost to reverse engineer a complex multi-layer PCB. In this paper, we introduce a new anti–reverse engineering method to protect PCBs from non-destructive reverse engineering. We add high-Z materials inside PCBs and develop advanced layout algorithms, which create inevitable imaging artifacts during tomography, thereby making it practically infeasible for an adversary to extract correct design information with X-ray tomography.

Counterfeiting is an increasing concern for businesses and governments as greater numbers of counterfeit integrated circuits (IC) infiltrate the global market. There is an ongoing effort in experimental and national labs inside the United States to detect and prevent such counterfeits in the most efficient time period. However, there is still a missing piece to automatically detect and properly keep record of detected counterfeit ICs. Here, we introduce a web application database that allows users to share previous examples of counterfeits through an online database and to obtain statistics regarding the prevalence of known defects. We also investigate automated techniques based on image processing and machine learning to detect different physical defects and to determine whether or not an IC is counterfeit.

Bond pull testing, a well-known method in the failure analysis community, is used to evaluate the integrity of an electronic microchip as well as to detect counterfeit ICs. Existing bond pull tests require that the microchip be de-capsulated in order to obtain physical access to the bond wires in the IC package. Bond pull analysis based on simulation and finite element methods also exists but relies on the original model for a bond wire from a CAD design. In this work, we introduce X-ray tomography imaging with 700nm imaging resolution to acquire the 3D geometry details of bond wires non-destructively. Such information can be used to develop more accurate models for finite element analysis based on real size and structure. Therefore, one can test the bond wire strength as a proof of concept for virtual mechanical testing and counterfeit detection in microchips.

X-ray tomography is a promising technique that can provide micron level, internal structure, and three dimensional (3D) information of an integrated circuit (IC) component without the need for serial sectioning or decapsulation. This is especially useful for counterfeit IC detection as demonstrated by recent work. Although the components remain physically intact during tomography, the effect of radiation on the electrical functionality is not yet fully investigated. In this paper we analyze the impact of X-ray tomography on the reliability of ICs with different fabrication technologies. We perform a 3D imaging using an advanced X-ray machine on Intel flash memories, Macronix flash memories, Xilinx Spartan 3 and Spartan 6 FPGAs. Electrical functionalities are then tested in a systematic procedure after each round of tomography to estimate the impact of X-ray on Flash erase time, read margin, and program operation, and the frequencies of ring oscillators in the FPGAs. A major finding is that erase times for flash memories of older technology are significantly degraded when exposed to tomography, eventually resulting in failure. However, the flash and Xilinx FPGAs of newer technologies seem less sensitive to tomography, as only minor degradations are observed. Further, we did not identify permanent failures for any chips in the time needed to perform tomography for counterfeit detection (approximately 2 hours).

Reverse engineering of electronics systems is performed for various reasons ranging from honest ones such as failure analysis, fault isolation, trustworthiness verification, obsolescence management, etc. to dishonest ones such as cloning, counterfeiting, identification of vulnerabilities, development of attacks, etc. Regardless of the goal, it is imperative that the research community understands the requirements, complexities, and limitations of reverse engineering. Until recently, the reverse engineering was considered as destructive, time consuming, and prohibitively expensive, thereby restricting its application to a few remote cases. However, the advents of advanced characterization and imaging tools and software have counteracted this point of view. In this paper, we show how X-ray micro-tomography imaging can be combined with advanced 3D image processing and analysis to facilitate the automation of reverse engineering, and thereby lowering the associated time and cost. In this paper, we demonstrate our proposed process on two different printed circuit boards (PCBs). The first PCB is a four-layer custom designed board while the latter is a more complex commercial system. Lessons learned from this effort can be used to both develop advanced countermeasures and establish a more efficient workflow for instances where reverse engineering is deemed necessary. Keywords: Printed circuit boards, non-destructive imaging, X-ray tomography, reverse engineering.

Possible methods for counterfeit electronic part detection can be classified into two main categories: physical inspection and electrical testing. The physical inspection techniques can potentially be extended to different integrated circuit (IC) types; however, there are some challenges. The major contribution of this paper is to tackle these issues by introducing and optimizing two novel three and four dimensional imaging techniques that can provide us with the necessary information on interior and exterior geometry along with the material composition for the parts under test: four-dimensional scanning electron microscopy and dual energy 3D x-ray microscopy. In this study, advanced image processing and image analysis tools are utilized to establish a more consistent and accurate image perception. Inconsistencies within the samples and their defects are also used as an alternative to having a golden IC. However, the final decision has further been validated using results from five known authentic samples.