Reverse Engineering on Microelectronic Devices · Reverse Engineering on Microelectronic Devices Example. Photodiode • Fault sample analysis • Comparison between different series

Open Days, May 20th, 2015

Centro Nacional de Microelectrónica Instituto de Microelectrónica de Barcelona

Reverse Engineering on Microelectronic Devices


Centro Nacional de Microelectrónica

Instituto de Microelectrónica de Barcelona

IMB - CNM – CSIC

Barcelona

Salvador Hidalgo ([email protected])




• Mixing of Physical Characterization and Design & CAD services. • Expertise:

Characterization of micro technologies

Physical analysis and edition of integrated circuits

Circuit analysis, modeling and simulation

EDA & CAD development, management and training

• Applications:

Failure diagnosis for integrated electronic components.

IC full design extraction (bottom-up): analog and digital ASIC

IC security study (top-down): Smartcard, FPGA and Microcontroller

Technological & CAD research and Industrial support

Group Overview




• Decapsulation

Die recovery • Microsection procedure

Technology information • High precision mechanical layer removal

Bottom-up circuit analysis Top-down circuit analysis

• Chemical stain of low doped diffusions Memory contents identification

• Laser-based circuit edition Security disabling

Techniques




• Direct probing On-line internal signal analysis

Techniques • FIB-based circuit edition

Internal controllability/observability Security disabling




Mechanical Delayering

• Layer extraction Bottom-up circuit analysis Top-down circuit analysis




Layers:

Metal 3

Metal 2

Metal 1

PolySilcon

Mechanical Delayering. Circuit Reconstruction




• Circuit extraction Electrical model Analog/digital functionality

Mechanical Delayering. Circuit Reconstruction




Example. Recovery and Encapsulation of a Commercial Circuit

Die recovery • Mechanical opening • Connection lines identification • Glop-Top dissolution • Die extraction • Maintaining the bonding wires on the die

Failure Diagnostic, Security, Data Recovery




Die recovery • Mechanical opening • Connection lines identification • Glop-Top dissolution • Die extraction • Maintaining the bonding wires on the die





Die Encapsulation • Ceramic prototyping package • Mechanical adaptation of the cavity • Die attach • Wires attach • Connection lines/pins identification • Package closed with a plastic lid or black Glop-Top





Example. Photodiode

• Fault sample analysis • Comparison between different series and providers • Plastic capsule removal and Die extraction • Die surface analysis • Structural problems localization and identification • Possible origin and solution

Failure Diagnostic, Quality Control




Example. Photodiode

• Fault sample analysis • Comparison between different series and providers • Plastic capsule removal and Die extraction • Die surface analysis • Structural problems localization and identification • Possible origin and solution




Example. Integrated Power Module (IPM)

• Control Integrated Power System designed to control AC motors in variable speed drives • Includes 3 half-bridges, integrated using IGBT and antiparallel diodes, combined with a 3 gate drivers to control its electrical performance • The system too integrates bootstrap diodes and capacitances, temperature sensors and passive components • Reverse Engineering techniques were used to perform the main steps of this study

Encapsulation removal (to allow the surface observation of the dices integrated in the module) Chemical etch (to clean the dices surface) Optical inspection (to localize the malfunction zones)

Driver-IC surface view Half-Bridge IGBT and Diode surface view

Failure Diagnostic, Quality Control












Target • Protected device memory access • Memory Code Protection bits (CP) localization and inhabitation

Top level surface overview Silicon level surface overview

Programmable Transistors Area Microcontrollers

Quality Control, Security, Data Recovery




Microcontrollers. First Approach

Top level surface overview Top level surface overview after UV window definition

UV process. Parameters to Determine

• UV wavelength ( 250 nm)

• Angle of incidence, • Distance to UV source, • Power of UV source, • Exposure time.

UV process. Operating Parameters • Low pressure germicidal lamp TUV PL-S 9W/2P (Philips)

• UV wavelength: = 253.7 nm,

• Power of UV source: 9 W, • Exposure time: 30 min, • All samples show their CP disabled, • Access to memory contents.




Microcontrollers. First Approach

UV erasing setup Top level surface overview after UV window definition

UV process. Parameters to Determine

• UV wavelength ( 250 nm)

• Angle of incidence, • Distance to UV source, • Power of UV source, • Exposure time.

UV process. Operating Parameters • Low pressure germicidal lamp TUV PL-S 9W/2P (Philips)

• UV wavelength: = 253.7 nm,

• Power of UV source: 9 W, • Exposure time: 30 min, • All samples show their CP disabled, • Access to memory contents.




Microcontrollers. Second Approach

CP’s inhabitation procedure • Metal cover over each transistor • Metal 2, under Metal 3 lines

If Metal 3 lines are active, rerouting using FIB,

If not, attack and removal by Laser.

• Laser procedure

Metal line removal only over the CP area (attack window),

Metal cover attack through this window,

UV process, Transistor destruction.

• We can modify the CP status, • We can disable the CP.




G1 G2

G2

G1

• Security mechanism analysis

CP bits location CP bits functionality CP bits integrity

• Possible activities to override CP action • Probe system, Laser opening, submicron needles interconnection • FIB opening, metal interconnection

• Block identification

Mechanical layer removal Top-Down analysis Block reconstruction Block interconnections

Microcontrollers. Third Approach




G2

G1

• Security mechanism analysis

CP bits location CP bits functionality CP bits integrity

• Possible activities to override CP action • Probe system, Laser opening, submicron needles interconnection • FIB opening, metal interconnection

• Block identification

Mechanical layer removal Top-Down analysis Block reconstruction Block interconnections

Microcontrollers. Third Approach




Purpose • Automation of the process used to perform Reverse Engineering of an IC

Digital Microchip Analysis

Main Drawbacks • 4 layers (Dimensions 36.000 x 32.000 pixels) • 3.000 Images per layer (12.000 total images) • 3.29 Gb each layer image • 15.000 Logic Gates • 65.000 Contact Points between logic gates terminals




• Mixing of Technological and Design & CAD profiles • Main Technical Profiles:

Physics

Chemistry

Engineering

Computer Science

• Career Opportunities:

Research, Development and Innovation Technological Research

CAD Research

Industrial Activities and Support

Security Procedures

TICs Electronic Applications On Chip Integration

Technical Profiles. Skills




Thank you for your attention !!!!

Questions ?

Documents

Reverse Engineering on Microelectronic Devices · Reverse Engineering on Microelectronic Devices Example. Photodiode • Fault sample analysis • Comparison between different series