616
6 Reverse Engineering of Microcircuits
Figure 6.88 shows another version of a modified (protected) CMOS structure.
The silicide layer extends both to heavily doped regions of the drain and source,
and to weakly doped LDD regions. If such changes are introduced in the CMOS
structure, n-channel transistor is stuck-open, since the electrical connection between
the LDD region 7a, substrate 1 and LDD region 7b is formed from the V 1 output
15 through the silicide layer 12; p-channel transistor is also stuck-open due to the
electrical connection formed from the V2 output 16 through the silicide layer 12,
LDD region 9b and well 13 to the LDD region 9a.
Conductivity type of LDD regions is extremely difficult to identify due to low
impurity concentrations. Additional difficulty is presented by detection of the thin
layer of silicide; therefore, the transistors with the design are modified using these
methods.
Introduction of such changes in transistor structures significantly increases the
complexity of IC reverse engineering, since it requires detailed analysis of each
transistor of the IC chip, which is difficult to implement in practice.
Change in the position of the silicide layer and doping type of LDD regions makes
it possible to combine various methods of modification of transistor structures in the
same technological process, providing an even wider selection of introducing masked
changes in the transistor design. Thus, all the above methods allow the developer to
effectively counter reproduction of the actual electrical circuit and identification of
the operation algorithm of the IC block.
6.7.3 Circuitry-Based Methods of Countering Microcircuit
Re-engineering
In this method of countering reverse engineering, the microcircuit is modified by
introducing inoperable (false) elements visually identified as standard functional
elements. For example, protection from reverse engineering is ensured by introducing
p-type and n-type MOSFETs in circuits of logic elements, which are stuck-open or
stuck-closed regardless of the value of input signals supplied to inputs of these
transistors. The use of such transistors makes it possible to change functions of logic
elements without altering the external pattern of the logic element pattern.
Stuck-open or stuck-closed transistors can easily be formed during serial production of chips by ion doping of the channel region or blocking ion doping of the
transistor channel region. However, to increase the level of protection of the circuit
from recovery, the use of the combination of circuitry-based and technology-based
methods of transistor structure modification (e.g., formation of LDD regions with
the conductivity type opposite to heavily doped source/drain regions).
As an example of implementation of circuitry-based transformation of IC logic
elements, we will consider the most common method of protection from reverse
engineering based on the fact that each logic element can contain at least one n-type
MOSFET that is stuck-open or stuck-closed regardless of the input signal level at
6 Reverse Engineering of Microcircuits
Figure 6.88 shows another version of a modified (protected) CMOS structure.
The silicide layer extends both to heavily doped regions of the drain and source,
and to weakly doped LDD regions. If such changes are introduced in the CMOS
structure, n-channel transistor is stuck-open, since the electrical connection between
the LDD region 7a, substrate 1 and LDD region 7b is formed from the V 1 output
15 through the silicide layer 12; p-channel transistor is also stuck-open due to the
electrical connection formed from the V2 output 16 through the silicide layer 12,
LDD region 9b and well 13 to the LDD region 9a.
Conductivity type of LDD regions is extremely difficult to identify due to low
impurity concentrations. Additional difficulty is presented by detection of the thin
layer of silicide; therefore, the transistors with the design are modified using these
methods.
Introduction of such changes in transistor structures significantly increases the
complexity of IC reverse engineering, since it requires detailed analysis of each
transistor of the IC chip, which is difficult to implement in practice.
Change in the position of the silicide layer and doping type of LDD regions makes
it possible to combine various methods of modification of transistor structures in the
same technological process, providing an even wider selection of introducing masked
changes in the transistor design. Thus, all the above methods allow the developer to
effectively counter reproduction of the actual electrical circuit and identification of
the operation algorithm of the IC block.
6.7.3 Circuitry-Based Methods of Countering Microcircuit
Re-engineering
In this method of countering reverse engineering, the microcircuit is modified by
introducing inoperable (false) elements visually identified as standard functional
elements. For example, protection from reverse engineering is ensured by introducing
p-type and n-type MOSFETs in circuits of logic elements, which are stuck-open or
stuck-closed regardless of the value of input signals supplied to inputs of these
transistors. The use of such transistors makes it possible to change functions of logic
elements without altering the external pattern of the logic element pattern.
Stuck-open or stuck-closed transistors can easily be formed during serial production of chips by ion doping of the channel region or blocking ion doping of the
transistor channel region. However, to increase the level of protection of the circuit
from recovery, the use of the combination of circuitry-based and technology-based
methods of transistor structure modification (e.g., formation of LDD regions with
the conductivity type opposite to heavily doped source/drain regions).
As an example of implementation of circuitry-based transformation of IC logic
elements, we will consider the most common method of protection from reverse
engineering based on the fact that each logic element can contain at least one n-type
MOSFET that is stuck-open or stuck-closed regardless of the input signal level at