Year: 2024
Type: conference-paper
Abstract: The switching transistors of an Integrated Circuit (IC) emit photons in a phenomenon known as photon emission. This emission allows for the observation of a circuit's activity and the reverse-engineering of its internal components. Under certain conditions, the data being processed can be retrieved using a technique called Photon Emission Analysis (PEA). This paper demonstrates how PEA may be employed to reverse-engineer and retrieve data from the Flash memory embedded in Microcontroller Units (MCUs). It describes the constraints and limitations of PEA while offering a comprehensive explanation of the mechanisms governing light emission in ICs. Detailed insights are provided into the optical setup, sensors used, and operational nuances of embedded MCU memory. To capitalize on the information presented, various scenarios for reverse-engineering the Flash array of an MCU are demonstrated using Space-Resolved Photon Emission Analysis. Additionally, an attack scenario exploiting the memory architecture asserted during the characterization phase is presented, demonstrating how secret data stored in the Flash can be retrieved by an attacker with the equipment detailed in this work.
Authors: Rodrigo Silva Lima, Raphael Viera, Jean-Max Dutertre, William Magrini, Matthieu Pommies, Anthony Bertrand
Language: English
Subfield: Hardware and Architecture
Field: Computer Science
Domain: Physical Sciences
Open Access status: gold
Award: G2434706083
OpenAlex ID: W4404515050