Integrated Chipscale Ultrasonic Communication Links
Prof. Amit Lal, Jason Hoople, Dr. Serhan Ardanuç
amit.lal@cornell.edu, jth234@cornell.edu, serhan.ardanuc@cornell.edu
SonicMEMS Laboratory, School of Electrical and Computer Engineering, Cornell University, Ithaca, NY, USA
Problem:
Integrated Circuit (IC) Reverse Engineering
Can Unlock Trade Secrets, Compromise
Product and National Security
• Application Specific integrated Circuits (ASIC),
Graphics Processing Units (GPU), and Pentium like
processor chips can be reverse engineered to unveil
market/trade secrets resulting in loss of invaluable R&D
know-how to competitors. Figure 1 shows an example
of reverse engineering performed by Chipworks Inc.[1]
sonicmems.ece.cornell.edu
Our Solution:
Chipscale Ultrasonic Reconfigurable
Communication Links with IC Compatible
Piezoelectric Layers as Acoustic Transceivers
Device and Technology:
Aluminum Nitride on IC circuits and PhasedDrive for Direction Control of the Acoustic
Beam
• Eliminate metal wiring between crucial parts of the chip (i.e.
FPGA Lookup tables, memory and ALU links, medium-speed
clocking and timing, etc) and use ultrasonic reconfigurable
links instead.
• Software defined, on-the-fly reconfigurable links prevent
reverse engineers to have access to the “full picture” just by
physical analysis of the chip itself.
• Use piezoelectric Aluminum Nitride (AlN) transducers as
acoustic transceivers, and use beam-forming principles and
phased drive for reconfigurability.
• Aluminum Nitride (a piezoelectric element) can convert
voltage signals to and from acoustic waves
• It can be deposited on top of CMOS ICs
Figure 4:Schematic cross
section and optical picture of
a fabricated AlN transducer
arrays with a pixel-to-pixel
spacing of 200 µm.
Send Pixel Voltage
1
After reflecting
off of the
bottom surface,
the wave is
detected by the
immediately
adjacent pixel
0.8
0.6
Voltage (V)
0.4
-5
0.2
2
Receive Pixel Voltage
x 10
0
1.5
-0.2
-0.4
1
-0.8
-1
0
SEM view of imager
pixels [1]
5
10
15
20
Time (ns)
25
30
Initial pulse leaves from
the left most pixel.
35
40
Voltage (mV)
-0.6
0.5
0
-0.5
-1
-1.5
-2
0
20
40
60
80
100
120
Time (ns)
140
160
180
200
Figure 5:Simulations show communication between two
pixels in an array due to bulk acoustic waves. Insets plot
the excitation and received signals.
Figure 1: Disassembly of a CMOS image sensor from a
camera module [1]
• While Moore’s law pushes the transistors dimensions
below 30nm, the tools available to reverse engineers
also constantly improve.
• Transistor level maps and metal routing can be
unveiled by advanced microscopy. Pattern recognition,
image stitching, pico-probing, FIB methods, and
sophisticated software tools even make encryption
keys stored in memories vulnerable.
Phased Array for Reconfigurability
Phased arrays have long been used in ultrasound imaging
for beam forming.
270
270
240
240
300
300
210
210
330
330
180
180
0
0
1
1
2
150
2
150
30
30
3
3
120
120
60
4
60
4
90
90
Figure 6: Simulations show that phasing AlN elements on
CMOS chips allows for focusing and direction of the beam.
Market and Other Applications
(a)
(b)
Figure 2: (a) Digital logic and schematic extraction from
layer by layer SEM pictures[1]. (b) Microsurgery altered chip
being probed to read encryption keys from the memory [1].
Figure 3: Center shows AlN transducer array embedded on top of
the metallization layer. These arrays will be distributed on top of the
chip as acoustic transmitter modules, which can communicate with
each other by proper phasing of sonar pulses sent at desired
angles. The pulses will reflect off the device boundary and be
incident on another sonar element. Alternatively Surface Acoustic
Waves (SAW) could be used to communicate laterally.
• ICs are ubiquitous, $300 Billion semiconductor market
• Other applications include tactile based acoustic
signature recognition and self-diagnosis of the chip to
check against possible trojans inserted by untrusted
semiconductor fabs.
References:
[1] Torrance, R.; James, D., Source, “The state-of-the-art in IC reverse engineering,”
Cryptographic Hardware and Embedded Systems - CHES 2009. Proceedings 11th
International Workshop, 363-81, 2009; 6-9 Sept. 2009, Lausanne, Switzerland.