T oma s D r a b , H a r d w a r e S e c u r i t y R e s e a r c h e r

Physics of SecurityInt roduc t i on to Fa i l u re Ana lys i s Too l s f o r IC Reverse Eng ineer ing and Ed i t i ng fo r Fun and P ro f i t

h t t p s : / / c y b e r w e e k . a e

10/14/2019 1

2

Table of Contents

• About me• Overview of Analysis Tools• How to make it cheap(er)?• Use Case• Recap

About me

§ Microelectronics at Brno University of Technology, Czech Republic§ Failure Analysis Engineer in semiconductor company§ Hardware Security Researcher in Xenithlabs

310/14/2019

Introduction to Failure Analysis

§ Methodology to reverse engineer failing behavior of own IC design in order to find the root cause of the failure

§ Whole industry based on one specific reason, to find the failure§ Uses a wide range of various physical phenomenon to visualize current flow,

highlight traces, localize shorts and leaks, or determine material composition§ Destructive FA methods involves chemical etching, mechanical grinding or milling,

laser cutting, ion milling

410/14/2019

Röntgen Microscopy (X-ray)§ Using high energy sub-UV

wavelengths 0.1-10 nm§ Three main sources• Xray tube• Transmission target• Synchrotron

§ Resolution down to 100 nm

§ Can see inside without damaging the sample

§ 3D images when combining images from different angles

10/14/2019 5

Decapsulation§ Manual chemical• Fuming nitric acid and sulfuric acid

mixture to dissolve plastic package and preserve wire bond and silicon die

• Using a small diameter pipette to create a drop of acid in the center of the chip

§ Automatic chemical• Using a prefabricated fixtures for each

package with opening for chemical access

§ Other methods• Laser decapsulation― Using a high power laser to evaporate

plastic package― Very fast process:

https://youtu.be/LIb__2FrT4s?t=10• Plasma etching― Using an O2 plasma to etch the plastic

package

10/14/2019 6

Optical inspection§ Type of light• Visible spectrum: 400 nm – 800

nm• Near Infra Red (NIR, SWIR): 800

nm – 1800 nm• Ultra Violet (UV): 400 nm – 10 nm

§ Illumination type• Reflected light for material

analysis• Scanning laser microscopes― IR laser scanning for IC analysis― UV laser scanning for high

magnification

§ Special types• Inverted IR microscope for

backside IC inspection• Confocal digital microscope for

surface analysis and height measurements

10/14/2019 7

Chemical Delayering§ Wet chemical etching• Various chemicals and chemical

compound to selectively etch layers of the silicon die

• Variables are concentration, temperature and time

• Most of the used chemicals are highly corrosive or even toxic!

§ Plasma etching• Plasma consists of ionized gaseous

substances• By applying high voltage, which tears

the gas molecules, ions are generated• Ions have specific chemical properties

and can be used to selectively etch various materials

10/14/2019 8

Grinding and polishing§ Using various hard material polishing

films and solutions, with grain size down to 0.01 um, to create cross section or remove layers from die surface

§ Parallel lapping or polishing• Mechanical removal of ICs layers• Works only with planarized technologies• Enables isolating and probing of blocks or

even individual components of Ics• Essential for revers IC engineering

§ Cross section (XS)• Allows to inspect internal structures of Ics• Targeting specific structure with micrometer

precision• Selective etching can show doping regions

10/14/2019 9

Microprobing§ Optical system• Reflected light microscope• Long working distance• Anti vibration stand

§ Positioners • With vacuum fixation to stand• XYZ micro movement

§ Probe types• Standard tungsten tips with tip

diameter down to 0.25 um• Tungsten gold plated• Beryllium-copper• Tungsten Carbide

§ Active probes• For high frequency measurements• High R and low C

10/14/2019 10

Nanoprobing§ SEM setup• Probe positioners attached to

stage― Moving with sample makes it easy to

view the sample, harder to change samples

• Probe positioners attached to the SEM chamber― Sample is moving independently

§ Probe XYZ movement is done by piezoelectric motors

§ Probe types• Usually tungsten probes• Electrochemically etched to fine tip• Optionally FIB is used to sharpen

tip and prolong the life of the probe

10/14/2019 11

Backside milling§ Specialized high precision CNC milling

machines in combination with IR laser measurement

§ Using various milling, grinding and polishing tips allows backside silicon thinning down to 1-2 micrometers

§ Allows backside IC inspection using IR microscopy

§ Enables backside PEM and OBIRCH analysis

§ Enables backside FIB IC circuit editing

10/14/2019 12

Photoemission Microscopy (PEM)§ Widely used defect localization

method§ When electron recombines with a

hole, a photon is emitted§ Recombination can occur in PN

junction, impurity in semiconductor, crystal lattice defect, gate oxide defect, ect.• Not only defects emits light, but all circuitry

which is engaged.

§ For silicon semiconductors, the emission spectrum lays in NIR

§ Microscope with low attenuation in NIR• Usually shared with microprobing system

§ High sensitivity, low noise CCD or InGaAscamera• Usually cooled to -50 °C

§ Frontside and backside analysis option

10/14/2019 13

Liquid Crystal Microscopy (LCM)§ Cheap, easy and very sensitive method

to localize shorts§ Molecules in liquid have an crystal

orientation§ Thermotropic liquid crystals change

crystal phase at specific temperature• Nematic, Chlolesteric and Smectic crystals• Can be observed using polarized light• K-18 SST is 29.9 °C

§ Microscope equipped with two circular polarizers and color CCD camera

§ Resolution up to 10 µm and 0.1 W§ Current loses which flows through a

defect generates heat, which change phase of thermotropic liquid crystals

§ Small layer of LC is applied directly on a die

§ By adjusting the current, the defect “breathes”

10/14/2019 14

Thermal Emission Microscopy§ Thermal emission microscope

uses special optics and sensor to create a temperature image of a sample

§ Microscope with special Beryllium optics with low attenuation in thermal emission range (3-10 µm)

§ Indium-InSb sensor• Sensitivity in 3.7-5.5 µm range• Each pixel measures temperature

independently• Temperature sensitivity 25 mK

§ Lock-in Thermography option• Modulates power and compares

ON/OFF thermal emission to eliminate background noise

• Works on a packaged dies

10/14/2019 15

OBIRCH/LIVA/TIVA§ OBIRCH – Optical Beam Induced

Resistance CHange§ L/TIVA – Light/Thermal Induced

Voltage Alteration§ Same principle, OBIRCH measures

change of current, LIVA/TIVA measures voltage

§ Thermal laser stimulation of a defect will change its resistance and it can be measured by Current/Volt-meter

§ By laser scanning the surface of the sample and synchronized V/A measurement an image can be generated

§ Other values can be also measured• Frequency, capacitance, digital output,

ect.

10/14/2019 16

OBIRCH/LIVA/TIVA§ OBIRCH/LIVA/TIVA are usually

part of sophisticated system, more analysis capabilities.• Usually it combines several

localization methods (PEM, DALS, Lock-in, ect.)

• High magnification IR microscope• Vis, NIR and Thermal laser• CCD and InGaAs high sensitivity

cooled cameras• Motorized stage and probing

positioners• Backside analysis option

§ Image acquisition and defect localization• Frontside or backside reference image• Probing of the IC• Superimposition of the images for

defect localization

10/14/2019 17

Scanning Electron Microscopy (SEM)§ Resolution down to 1 nm§ Requires high vacuum § Sample preparation§ Two main types of electron

guns• Directly heated cathode― Usually tungsten filament― Lower magnification, but

cheaper• Field Emission Gun (FEG)― Electrons are pulled from the

tungsten tip with high voltage― Higher resolution― More expensive

§ Two basic detection methods• Secondary electrons (SE)• Backscattered electrons

(BSE)

BSE

SE

10/14/2019 18

Energy-Dispersive Xray Spectroscopy (EDS, EDX)§ SEMs are usually equipped with EDS

detector§ Electron hitting the sample, causes

excitation of electron, which when returned to lower energy releases the characteristic energy spectrum

§ Each element has characteristic emission spectral lines

§ By using SEM scanning and EDS analysis, material maps can be acquired

10/14/2019 19

Focused Ion Beam (FIB)§ Ions pulled from liquid or plasma by high

voltage are accelerated and focused to single point• Most common are Gallium ions (Liquid Metal Ion Source

LMIS)• Xe and He plasma FIBs are evolving tools for high

material removal (Xe) or high precision milling (He)

§ Accelerated ions can mill into materials§ Countless applications• Ultra precise XS• TEM lamella • Material deposition• Circuit editing• High resolution tomography

10/14/2019 20

Electron Beam Induced Current (EBIC)§ Accelerated electron can

generate electron-hole pair§ In depletion region the pair is

separated and current is generated

§ EBIC picoampermeter creates image

§ Easily integrated in SEM with just 2 probes and amplifier

§ Can visualize PN junctions and quantify doping• Ideal for doping defects detection• Crystalline defects detection• Gate oxide defects

§ Only few µm under the surface• XS analysis is an option

10/14/2019 21

Electron Beam Absorbed Current (EBAC, RCI)§ Usually the same system as for

EBIC§ Electron is introduced into a

metal line and generated current can be measured

§ By scanning the surface an image of a net can be obtained

§ Ideal for metal line tracking in Ics

§ Detection of opens, shorts, or failed vias

§ Low depth detection

10/14/2019 22

Evolving localization methods§ Lock-in Thermography• Deduces noise by synchronizing the timing of

power supply to a device and image capture

§ EBIRCH• Electron Beam Induced Resistance Change• Similar to OBIRCH, but using electron beam

of a SEM system• Much higher resolution• Low depth measurements

§ Electro Optical Probing (EOP)• Potential to measure high frequency signals

without loading on a circuit

§ Electron Beam Probing/ Dynamic Voltage contrast

§ Fluorescent Microthermographic Imaging

10/14/2019 23

Other Physical analytical methods§ Raman Spectroscopy

• Relies on inelastic scattering of monochromatic light. Laser interacts with molecules and photons energy is shifted. The shift gives information about the material

§ Auger Electron Spectroscopy• Auger electrons are created in depth of only a few

nanometers. Unlike EDS, which collect information from few micrometers, Auger can give information about surface material composition.

§ Laser Cutting• Uses high energy focused laser beam, to evaporate

conductive or dielectric materials to edit an integrated circuit

§ Reactive Ion Etching (RIE)• Similar to plasma etching• Ions are directional and allows higher plasma density and

etching control

§ Secondary Ion Mass Spectrometry (SIMS)• Most sensitive surface spectrometry method• Ion gun shoots primary ions, which sputters secondary ions

from a sample and they are extracted and analyzed by a mass spectrometer

§ Scanning Acoustic Tomography• Using ultrasound in MHz frequencies• Any change in solid material causes attenuation of

transmitted soundwave, and air gap causes phase inversion of the reflected wave

§ Transmission Electron Microscopy• Acceleration voltage in hundreds of kV• Focused electron beam is scattered at crystal lattice of a

thin sample and is projected on a detector• Resolution at atomic level

§ Atomic Force microscopy• Scanning a surface with a tip with a resolution up to

fractions of nm• Different measurement modes

• Contact mode: AFM tip is dragged on the surface• Tapping mode: Tip oscillates with amplitude up to 200

nm• Non-contact mode: AFM tip oscillates at resonance

frequency and by measuring change of frequency topography can be calculated

10/14/2019 24

How to make it cheap(er)?

§ Replacing expensive equipment with skill§ Commercial electronics getting better and can

be modified§ Second hand market§ Outsourcing/equipment renting

10/14/2019 25

Microscopy and IR microscopy

§ Optical microscope as an essential instrument for IC analysis

§ Creation of IR light• IR LEDs• Filtering wide spectrum light source

§ Detection of IR light• Spectral response of Si based sensors is

limited• Modification of commercial cameras• Dedicated astro-photography cameras• For PEM analysis cooled inverted chip is

necessary

10/14/2019 26

Decapsulation

§ Expensive tools can be replaced with skills

§ Cost of decapsulation reduced to cost of chemicals

10/14/2019 27

IC Delayering

§ Suitable cloth• Velvet, or porous rubber

§ Fine grain polishing powder• Aluminum oxide or silicon oxide• Less than 1um

§ High viscosity medium• Glycerine

§ Ton of patience…

10/14/2019 28

IC editing

§ Laser IC editing is outdated method, but still works

§ second-hand products available§ Requires more samples to perfect the

process§ Different wavelengths for different

materials

10/14/2019 29

Example

§ Microchip 8 bit microcontroller§ Programming Lock for Software Security• Lock fuse stores lock value• Built against erasing

10/14/2019 30

Fuse location

10/14/2019 31

Delayering

10/14/2019 32

Delayering

10/14/2019 33

Delayering

10/14/2019 34

Cross section

10/14/2019 35

Reverse engineering

10/14/2019 36

Schematic redraw

10/14/2019 37

Identifying programing trace

10/14/2019 38

Prog.

Prog_2

Out

Identifying programing trace

10/14/2019 39

Prog.

Prog_2

Out

Delayering

10/14/2019 40

Prog. Prog_2

Out

Further study

10/14/2019 41

Summary

§ Failure Analysis is a whole industry dedicated to find a root cause of a failure§ Uses wide variety of physical phenomenon for analysis§ Uses highly specialized tools for reverse engineering§ These tools are becoming cheaper and more accessible and some we can replace

with skill§ Complete reverse engineering is not necessary, if you identify correct traces

10/14/2019 42

43

Thank you!