阐述两种针对芯片的侵入式攻击方法,即扫描电镜(SEM)探测和探针攻击.攻击的目标都是从EEPROM中提取数据内容,EEPROM因为通常会存储认证信息和个人密钥等敏感信息.描述两个实验过程,第一个实验利用非易失性存储器的存储特点,对一个通用存储器芯片进行预处理后直接使用SEM进行观测,试图从图像上辨别不同存储状态的单元并且定位单个存储器单元;第二个实验对某款芯片预处理后,针对单个EEPROM存储器单元晶体管各端口进行电学连接,制作焊盘(PAD),之后使用探针探测存储器单元工作电信号,从而区分不同状态的单元.
This paper proposed two invasive attack methods against semiconductor chips, and these two methods are SEM search and probing attack, respectively. Their goals are both extracting contents from EEPROM which usually keeps sensitive information such as authentication information and personal keys. Two experiments process were shown in this paper. By making use of features of nonvolatile memories, the first one used SEM to observe target EEPROM cells to distinguish cells which store different contents and to locate EEPROM cells with certain memory chip pre-processed. The second one used needles to test working signals of memory cells by contacting PADs which connect electrodes of memory cell transistors to distinguish different cells.