What is Laser fault injection?

A fault injection attack that fires short pulses of laser light at a chip whose package has been opened, creating currents near transistors or memory cells to cause malfunctions at a chosen place and time. Near-infrared light around 1 µm, which silicon absorbs only weakly, is often shone through the thinned substrate from the back side, allowing the target to be chosen precisely. It is countered with light sensors, duplication of critical computations and mechanisms that erase keys when errors are detected.

Japanese name: レーザ故障注入

Laser fault injection appears in 1 practice question across 1 topic, including Hardware Security: Advanced Topics and Trends.

Field: Hardware Security: Advanced Topics and Trends

Try it: questions about Laser fault injection

Among fault injection attacks, which correctly pairs the characteristics of methods using a laser and methods using electromagnetic pulses?

  1. AA laser is often shone with near-infrared light from the back of a decapsulated chip and can target places very precisely. EM pulses are applied with a coil and sometimes work without decapsulation, but the area they affect is relatively wide
  2. BA laser passes through the package resin, so it can hit a chosen single transistor without decapsulating the chip. EM pulses cannot be used unless the chip is ground down to expose the wiring
  3. CBoth lasers and EM pulses suddenly raise the temperature of part of the chip and melt wiring or transistors, changing the circuit's function by causing permanent damage
Show answer and explanation

Answer: A. A laser is often shone with near-infrared light from the back of a decapsulated chip and can target places very precisely. EM pulses are applied with a coil and sometimes work without decapsulation, but the area they affect is relatively wide

The bandgap of silicon is about 1.12 eV, and light with wavelengths longer than about 1.1 µm is hardly absorbed. Near-infrared light around 1 µm is only weakly absorbed, so it penetrates deep from the back of a thinned substrate and is partly absorbed near the transistors, creating electron–hole pairs. The front side is covered by many metal wiring layers, so laser fault injection usually shines from the back, using the photocurrent to make specific transistors or SRAM cells malfunction. With EM pulses, a large current is passed through a coil briefly to create a strong change in magnetic field, which induces voltages in the chip's wiring and power grid and causes malfunctions. Countermeasures combine sensors that detect light or electromagnetic fields, duplication of critical computations and mechanisms that erase keys when errors are detected.

Laser fault injection in the explanations

Questions that mention Laser fault injection (1)

  1. Among fault injection attacks, which correctly pairs the characteristics of methods using a laser and methods using electromagnetic pulses?

Books on Hardware Security: Advanced Topics and Trends Ad

As an Amazon Associate I earn from qualifying purchases.

Related terms

Arm CCA (Confidential Compute Architecture) CHERI Confidential computing Control-flow integrity DICE (Device Identifier Composition Engine) FIPS 140-3 Hardware bill of materials (HBOM) Logic locking Memory Tagging Extension (MTE) Number-theoretic transform

Back to the glossary