Cryptography hardware is vulnerable to side-channel (SC) attacks on power supply current flow and electromagnetic (EM) emission. This article proposes simulation-based power and EM side-channel leakage analysis (SCLA) techniques on a cryptographic integrated circuit (IC) chip in system level assembly. SCLA measures SC leakage metrics including T-score, SC leakage score, and the number of measurement traces to disclosure, leveraged by a secure system-on-chip design flow toward SC attack resiliency and SC leakage sign off. Power SCLA features the tracking of security sensitive registers within cryptographic logic paths and the automatic assignments of probe points on associated physical power nets. Power supply current traces are efficiently simulated for the large set of input payloads, with direct vector-based and vector-less random switching controls. EM SCLA evaluates magnetic fields created by every piece of metal wiring in metal stacks where power supply current of cryptographic processing flows. The EM emission and EM SCLA from the backside Si surface of an IC chip in flip-chip packaging are experimentally examined with a 0.13 μm test chip. The proposed simulation-based SCLA exhibits the SC leakage metrics of on-chip location and direction dependency as accurately as in the measurements.

Current source based cell models are becoming a necessity for accurate timing and noise analysis at 65 nm and below. Voltage waveform shapes are increasingly more difficult to represent as simple ramps due to highly resistive interconnects and Miller cap effects at receiver gates. Propagation of complex voltage waveforms, and accurate modeling of nonlinear driver and receiver effects in crosstalk noise analysis require accurate cell models. A good cell model should be independent of input waveform and output load, should be easy to characterize and should not increase the complexity of a cell library with high-dimensional look-up tables. At the same time, it should provide high accuracy compared to SPICE for all analysis scenarios including multiple-input switching, and for all cell types and cell arcs, including those with high stacks. It should also be easily extendable for use in statistical STA and noise analysis, and one should be able to simulate it fast enough for practical use in multi-million gate designs. In this paper, we present a gate model built from fast transistor models (FXM) that has all the desired properties. Along with this model, we also present a multithreaded timing traversal approach that allows one to take advantage of the high accuracy provided by the FXM, at traditional STA speeds. Results are presented using a fully extracted 65 nm TSMC technology.

Modeling the effect of coupling noise on circuit delay is a key issue in static timing analysis (STA) and involves the “victimaggressor alignment” problem. As delay-noise depends strongly on the skew between the victim-aggressor input transitions’, it is not possible to apriori identify the victim input transition that results in the latest arrival time at the victim. Several approaches that heuristically search for the worst-case victim-aggressor alignment have been proposed in literature. In this paper we present an analytical result that obviates the need to search for the worst-case victim input transition, thereby simplifying the victim-aggressor alignment problem significantly. Using the properties of standard nonlinear CMOS drivers, we show that regardless of the switching of the aggressors, the worst-case victim input transition is the one that switches at the latest point in its timing window. Although this result has been empirically observed in the industry, to the best of our knowledge, this is the first work that provides a rigorous analysis and shows that the result holds for both linear and non-linear drivers. We also show that limiting the alignment of the victim to only the latest victim input transition can significantly reduce the runtime of existing heuristic techniques with no loss of accuracy.