Reversing stealthy dopant-level circuits

Abstract

A successful detection of the stealthy dopant-level circuit (trojan), proposed by Becker et al. at CHES 2013 (LNCS 8086:197–214, 2013), is reported. Contrary to an assumption made by Becker et al. dopant types in active region are visible with either scanning electron microscopy (SEM) or focused ion beam (FIB) imaging. The successful measurement is explained by a technique called the passive voltage contrast (Rosenkranz J Mater Sci Mater Electron 22(10):1523–1535, 2011) which is used to analyze failures in large-scale integration (LSI). The experiments are conducted by measuring a dedicated chip. The chip uses the diffusion programmable device (Shiozaki et al. Diffusion programmable device: a device to prevent reverse engineering, IACR Cryptology ePrint Archive 2014/109 2014): an anti-reverse engineering technique by the same principle as the stealthy dopant-level trojan. The chip is delayered down to the contact layer, and images are taken with (1) an optical microscope, (2) SEM, and (3) FIB. As a result, the four possible dopant–well combinations, namely (i) p+/n-well, (ii) p+/p-well, (iii) n+/n-well and (iv) n+/p-well are distinguishable in the SEM images. Partial but sufficient detection is also achieved with FIB. Although the stealthy dopant-level circuits are visible, they potentially make a detection harder. That is because the contact layer should be measured. We show that imaging the contact layer is at most 16 times more expensive than that of a metal layer in terms of the number of images.

Appendix: Estimating the number of images per gate

The relationship between (i) the number of gate elements, (ii) chip area, and (iii) the number of images is estimated.

As a target, we use an open-source AES core called AES_Comp [18]. The core is synthesized with the standard-cell library for the Rohm 180-nm process. The total cell area is 288,000 $\upmu \mathrm{m}^2$. The area corresponds to about 15 kGE. The utilization ratio after place and route is assumed to be 70 %. Then, the AES core uses about 411,000 $\upmu \mathrm{m}^2$ (=288,000/0.7).

In SEM imaging with $\times$1.5k magnification, an area involved in a single image is about 5,000 $\upmu \mathrm{m}^2$ ($\approx$63 $\upmu$m $\times$ 84 $\upmu$m). Therefore, we need about 77 ($\approx$411,000/5,000) shots to cover the AES core. If we normalize the number of shots by the gate counts, we get 5.16 shots/kGE.