True-PolyTronik: Securing Circuits Against Laser Logic State Imaging Attack Using RFET

Abstract

It has been shown that an adversary equipped with Optical Probing (OP) capabilities can modulate the power supply of a design with a low frequency and low amplitude signal, and extract the static state of transistors in a design. This OP technique, known as Laser Logic State Imaging (LLSI), has been successfully exploited to extract the data in SRAM blocks, combinational circuits, and more. Several mitigation techniques exist against LLSI attacks, however, they are often power-hungry, require large amplitude modulation of the power supply to function effectively, or necessitate the inclusion of a laser light sensor detection on the chip, making them costly solutions. Additionally, other techniques require a change in the transistor fabrication steps, making them costly to integrate into the CMOS fabrication process. In this work, we explore Reconfigurable Field Effect Transistor (RFET) technology, which can be reconfigured at runtime to function as either a PMOS or NMOS transistor to mitigate LLSI attacks on chips. Additionally, the RFET technology is compatible with CMOS fabrication and it has been shown to integrate seamlessly into existing CMOS technology. We demonstrate that with the aid of RFET technology, we can design effective logic cells capable of detecting even small power supply modulation which is a prerequisite for LLSI attack. This enables us to configure logic cells in a manner that corrupts their static state upon LLSI attack. We implement this mitigation technique against LLSI attacks by biasing the program pins of RFET-based logic cells such that, when the supply voltage drops, the logic cell alters its original intended behavior and generates gibberish data. We demonstrate our approach on several combinational logic cells and D-latch cells. Next, we propose an RFET-based biasing circuitry design that produces stable voltage for the program pins of RFETs, upon LLSI attack on the chip. Finally, we also evaluate the performance of our approach by comparing the logic cells when they are protected using our proposed technique versus when they are unprotected.