Flip-chip BGA (ball grid array) implementation offers advantages such as shorter signal wires and a smaller footprint compared to conventional wire-bonding face-up packaging technology. These characteristics are also well-suited for advanced packaging technologies such as 2.5D or 3D packaging. Si-substrate backside of IC chips are open and exposed in flip-chip packaging. In the context of hardware security, attackers can access to the backside of an IC chip easily and use the Si-substrate backside as a contact point for fault injection and side-channel attacks. In this paper, we show that high voltage pulsing (HVP) injection over Si-substrate backside could be a serious threat as IC chips become thinner for low profile and chip stacking. First, using simulations comparing injection from the frontside and from the backside, we show that the HVP injection from the backside has the characteristic ability to induce faults in targeted circuits over a small area and explain the physical mechanism behind this ability. It is also shown that this ability becomes more pronounced as IC chips become thinner. Secondly, we prepare a Si prototype chip and confirm this characteristic ability by experimental results. It is shown that HVP over Si-substrate backside can target flip-flops (the size of each flip-flop is about $13 \mu \mathrm{m}$ times $3 \mu \mathrm{m}$) in the area with an accuracy of about $50 \mu \mathrm{m}$ times $50 \mu \mathrm{m}$ and reproducibly causes bit flips associated with the targeted bytes. Finally, the threat of this attack is demonstrated by performing differential fault analysis (DFA) on AES-128bit and obtaining entire secret key bytes.

Circuits for cryptography are vulnerable to side-channel (SC) attacks. Masking is a countermeasure which splits secrets into random shares. It is provable secure under the assumption that physical leakage of each share is independent of each other. For a secure implementation of masked circuits, this independency assumption must be satisfied after layout. A transistor-level simulator such as SPICE produces analog waveforms that are sufficiently trustworthy to verify timing accuracy. Due to this accuracy, SPICE is expected to be useful for SC leakage verification after layout. However, we demonstrate that the statistical variation of the power noise amplitude in SPICE simulation is not always correct and varies a lot for SC evaluation. We believe it results from the internal time-step creation optimized for efficiency. It causes false-positives in the verification of security order. A small nonlinear function with a domain-oriented masking scheme is used to demonstrate these SPICE-simulation anomalies.

Cryptography hardware is vulnerable to side-channel (SC) attacks on power supply current flow and electromagnetic (EM) emission. This article proposes simulation-based power and EM side-channel leakage analysis (SCLA) techniques on a cryptographic integrated circuit (IC) chip in system level assembly. SCLA measures SC leakage metrics including T-score, SC leakage score, and the number of measurement traces to disclosure, leveraged by a secure system-on-chip design flow toward SC attack resiliency and SC leakage sign off. Power SCLA features the tracking of security sensitive registers within cryptographic logic paths and the automatic assignments of probe points on associated physical power nets. Power supply current traces are efficiently simulated for the large set of input payloads, with direct vector-based and vector-less random switching controls. EM SCLA evaluates magnetic fields created by every piece of metal wiring in metal stacks where power supply current of cryptographic processing flows. The EM emission and EM SCLA from the backside Si surface of an IC chip in flip-chip packaging are experimentally examined with a 0.13 μm test chip. The proposed simulation-based SCLA exhibits the SC leakage metrics of on-chip location and direction dependency as accurately as in the measurements.

On-chip monitor (OCM) circuits capture dynamic power-supply (PS) waveforms within power domains individually bounded by dedicated micro voltage regulator modules (μVRMs). This paper uses OCM to diagnose VLSI circuits with a modular power management, where the evolution over time of the gate switching count, in the clock tree, the flip-flops, and the combinational logics are precisely captured in the OCM voltage waveforms. A mismatch between simulation and measurement gives us a warning for either (1) faulty behavior in the IC hardware, or (2) bugs in the test program. In this paper, we demonstrate an IR-drop-based toggle diagnosis technique using OCM for a prototype chip in 180 nm technology. The OCM measurements at 100 ps and 100 μV are capable of reaching a resolution of 18.7 fC/gate. This is approximately equivalent to the amount of charge consumed by a single two-input NAND gate.