Fake ICs: Another weapon in their detection

-May 22, 2017

In his book The Hardware Hacker, Andrew "bunnie" Huang dedicates a chapter to fake ICs and the methods by which counterfeit parts make their way into the supply chain. While fake parts cause problems in every sector of electronics manufacturing, it's a significant problem for military electronics. Huang writes:

The variety of counterfeiting methods available, combined with the fact that many commodity parts have production cycles of just a few years, presents a big problem for institutions like the US military, where design lifetimes are often measured in decades.

Huang goes on to describe several methods for identifying counterfeit ICs—both internal and external to the part—but all of them have limits. For example, it's impossible to test every gate in an FPGA to look for rogue configurations in a reasonable amount of time. Electron microscopes can see an IC's details down to a single nanometer, but they require destructive chemical or mechanical methods of removing each layer. Nondestructive techniques of looking inside an IC require the equipment available only at national labs; getting time at such a facility isn't easy.

To address the problem, engineers at BAE Systems are developing a technology in conjunction with the Intelligence Advanced Research Projects Activity (IARPA) that will let them "see" into an IC's layers. The goal of the Rapid Analysis of Various Emerging Nanoelectronics (RAVEN) project is to develop a tabletop system that can detect a device's traces and interconnects with 10 nm resolution at any layer. With that kind of vision, engineers could not only see an IC's construction layer-by-layer, but detect the materials and dopants used in the device. That kind of insight could let engineers not only detect differences between real and counterfeit ICs, it could help identify if the IP in an FPGA is authentic and free of malware. Going further, such insight could reveal manufacturing differences that can uncover long-term reliability problems.

"There's a concern in defense industry to understand and secure the supply chain," said Mike Richman, Technical Director for Video, Image, and Spectral Exploitation at BAE Systems. "Where are circuits coming from? Can we trust them? Defense contractors need to prove that devices are what they say they are. We have no way to be 100% sure that an IC is what the supplier claims. We can run tests, but can't see inside well enough."

In addition to securing the supply chain, having a vision system capable of viewing each layer could have other advantages. "Manufacturing variability can affect the physical features of the IC parts," said Chief Scientist Eugene Lavely. "This can cause premature aging because various degradation processes have exponential dependence on the physical dimensions of the device components. If you can image chip variability, and then make measurements of how a chip ages over time, you can better understand the physics of degradation and improve future designs. That's why we don’t want to destroy parts."

Currently, the only way to get a look into an IC's layers without destroying it requires an x-ray source of sufficient brilliance and an imaging system of sufficient resolution. Such capabilities are usually only possible with a synchrotron, which is typically available only at national laboratories such as Argonne (Figure 1), Brookhaven, and the Stanford Linear Accelerator.

text

Figure 1 The synchrotron at Argonne National Laboratory can create the x-rays required to "see" inside an IC.

Because there are only about 70 synchrotrons in the world, engineers must compete with medical and other researchers for synchrotron time. Thus, evaluating in IC can take months. One goal of the RAVEN project is to acquire the images of an IC within 25 days. Plus, synchrotrons are billion-dollar facilities. To make IC imaging practical, the cost of an imaging system needs to be at most in the few million-dollar range so it can be used in government, industry, and university labs.

Another issue with relying on synchrotrons stems from the fact that only a tiny fraction—about 100 µm²—of the area of a typical IC can be imaged in a typical experiment session. Thus, it takes many beam time allotments to assemble the entire area of an IC. When you can only get beam time from a national lab perhaps once every six months, obtaining an IC's image takes too long to be practical. Beyond this, it is challenging even for a synchrotron to meet the RAVEN program’s required 10 nm resolution. The best obtained results at a synchrotron so far is about 14 nm.

The development of a tabletop system for IC imaging to address the above practical and technical issues must itself overcome several problems. For BAE's design, these issues include

  • Generating sufficient x-ray flux. BAE engineers are using a non-synchrotron source, leading to signal-to-noise ratio (SNR) challenges.
  • Achieving sufficient resolution. The design doesn't use advanced x-ray imaging optics.
  • Overcoming challenges in mechanical and thermal stability of system components. Even a small temperature change can cause 1 micron displacement, destroying the required 10 nm resolution.
  • Identifying the chemical materials used in each IC layer.
  • Designing a stage for the IC sample and holder with sufficient precision for the resolution required.

Figure 2 shows a block diagram of the RAVEN system under development at BAE Systems. An electron beam (e-beam) scanning electron microscope (SEM) column focuses accelerated electrons onto the sample. Before an IC can be inspected, the underlying silicon substrate must be thinned from about 300 µm to less than 1 µm, which leaves the device layer and metallization layers intact. Thinning lets the bean reach to metallization layers with sufficient brilliance.

text

Figure 2 A block diagram of the imaging system shows how an incoming e-bean results in x-rays that can be detected and processed into an image. Courtesy of BAE Systems.

The e-beam probe of approximately 10 nm diameter first hits a 10-nm thin-film target made of gold that's attached to a diamond membrane. The diamond gives the target mechanical strength. When the e-beam hits the gold, x-rays are produced by a fluorescence phenomenon. These x-rays pass through the diamond and a vacuum microgap, and then through the sample unless they are absorbed by IC materials such as copper, tungsten, and aluminum. These materials absorb x-rays at different rates, each with a unique x-ray energy. The absorption decreases measured x-ray intensities. Computational algorithms can then process the data identifying the materials on each layer and the 3D structure of the sample IC.

Why thin the Si substrate? Lavely explained, "The thin backside reduces attenuation of the signal. If we use a thicker target, say 100 nm instead of 1-2 nm, we would get more x-ray flux. That increases SNR at the cost of resolution. We know that as we go up the stacks of an IC, the layer thicknesses increase. You don't need 10 nm resolution to characterize an IC at the higher layers."

The far end of the chamber holds a transition edge sensor (TES) that measures individual photons and with extremely high energy resolution. A superconducting technology, the TES must be at an extremely low temperature, approximately 0.1 K. BAE Systems engineers get the equipment from NIST to achieve that temperature. In a superconducting state, the TES resistance changes based on the photons that reach it. That can be measured with 4eV of energy resolution, which is very important for resolving individual spectral lines. This technique increases SNR by as much as 20 dB relative to that for conventional energy-sensitive detectors used in X-ray studies, such as the Silicon Drift Detector.

There's a tradeoff between image resolution and SNR. The closer the sample gets to the e-beam source, the better the image resolution. Longer distances from the sample to the detector produce better image resolution (distance²). That is, the x-rays spread out, providing the results across more sensor pixels. The distance from the sample to the detector can, therefore, range from 10 cm to 60 cm. When the TES is close to the sample, it receives more photons, providing higher SNR but less spreading, thus less resolution. Varying the distance and using different target thicknesses help in implementing optimal data collection plans. Figure 3 compares resolution between using the TES versus a more traditional SDD sensor. You can see the tighter resolution in both examples.

text

text

Figure 3 Comparison of SDD (140 eV resolution, green traces) and TES (4 eV resolution, blue traces) sensors using an example of a 10 nm gold layer under a 10 mm Cu, SiO2 mixed layer at different energies. Courtesy of BAE Systems.

To produce an image of a metallization layer, the system detects x-rays at high and low resolutions and with diverse ray-sampling geometries for a given voxel in the sample. Once the data is gathered, a computer uses statistical iterative reconstruction of the IC layers to produce the images. The algorithms use maximum likelihood principles and statistical noise models for photons based on a Bayesian formulation that uses priors on parameters. These algorithms give flexibility and enable model estimation, even with low SNR.


Loading comments...

Write a Comment

To comment please Log In

FEATURED RESOURCES