Modulation to the Rescue: Identifying Sub-Circuitry in the Transistor Morass for Targeted Analysis

TL;DR

This paper introduces optical and thermal techniques, LLSI and LIT, to efficiently identify sub-circuitry in unknown integrated circuits, significantly reducing attack complexity and enhancing precision in physical security threats.

Contribution

It presents and compares two novel methods, LLSI and LIT, for rapid sub-circuit identification in ICs, improving attack efficiency and precision.

Findings

LIT and LLSI can reduce search space by 90-98%

Techniques enable targeted physical attacks with lower complexity

Application demonstrated on Intel H610 Platform Controller Hub

Abstract

Physical attacks form one of the most severe threats against secure computing platforms. Their criticality arises from their corresponding threat model: By, e.g., passively measuring an integrated circuit's (IC's) environment during a security-related operation, internal secrets may be disclosed. Furthermore, by actively disturbing the physical runtime environment of an IC, an adversary can cause a specific, exploitable misbehavior. The set of physical attacks consists of techniques that apply either globally or locally. When compared to global techniques, local techniques exhibit a much higher precision, hence having the potential to be used in advanced attack scenarios. However, using physical techniques with additional spatial dependency expands the parameter search space exponentially. In this work, we present and compare two techniques, namely laser logic state imaging (LLSI) and lock-in thermography (LIT), that can be used to discover sub-circuitry of an entirely unknown IC based on optical and thermal principles. We show that the time required to identify specific regions can be drastically reduced, thus lowering the complexity of physical attacks requiring positional information. Our case study on an Intel H610 Platform Controller Hub showcases that, depending on the targeted voltage rail, our technique reduces the search space by around 90 to 98 percent.