CSCI/ECSE 4xxx/6xxx Semiconductor Reverse Engineering

This page is a DRAFT. As of this writing the course has not been submitted for approval to the department or registrar and may change substantially or not be offered at all.

The current target is to offer this course during the spring 2014 semester at RPI.

RPI's IP policy states that lecture slides, etc remain the property of the creator(s). We plan to release them under CC-BY-SA.

If allowed by department/institute policy, we would like to tape the lectures and make them available online to the public. (The IP policy is a little unclear on this, need to talk to some folks).

Reverse engineering techniques for semiconductor devices and their applications to competitive analysis, IP litigation, security testing, supply chain verification, and failure analysis. IC packaging technologies and sample preparation techniques for die recovery and live analysis. Deprocessing and staining methods for revealing features below top passivation. Memory technologies and appropriate extraction techniques for each. Study of contemporary anti-tamper/anti-RE methods and their effectiveness at protecting designs from attackers. Programmable logic microarchitecture and the issues involved with reverse engineering programmable logic. Real-world case studies built around off-the-shelf commercial ICs ranging from above the 1 μm node down to 45nm and below.

The course is largely self-contained and will introduce the necessary chemistry, physics, and layout technologies required for a qualitative (rather than quantitative) understanding of the functioning of semiconductor devices. ECSE 2610, MATH 2800+CSCI 2500, or equivalent understanding of gate-level Boolean logic is required.

There is no textbook. Students may find the siliconpr0n.org wiki a valuable supplement to the lecture materials and are encouraged to read other papers, etc. which may be linked from the wiki or mentioned in class.

Your grade will be based on four components, weighted equally:

At the start of the second lecture of each week, there will be a short (15) minute in-class quiz covering the most recently used material. The primary emphasis of the quizzes will be demonstrating your ability to apply knowledge, not memorize facts. For example, you may be given a photo of a simple standard logic cell and asked to produce a transistor-level schematic.

Quizzes are to be taken individually with no help from other students or use of outside resources (textbooks, computers, etc).

About once a month, there will be a laboratory demonstration showing off sample preparation, invasive attacks, data capture, etc. Depending on enrollment and available resources, there may or may not be a hands-on component to some or all of the labs. You will be expected to write a short (1-2 page max) report after each lab session describing the procedures performed and the results obtained.

You may discuss labs freely with other students but must write up reports individually.

There will be several homework assignments over the course of the semester. These will be similar in nature to the quizzes but involve larger-scale problems. For example, instead of simply creating a schematic from a single gate, you may be given photos of a larger part of a device and expected to produce a gate-level schematic.

You may work in groups on the homework but must write up solutions individually. You may not receive direct help from any person who is not a student of the class without the permission of the instructor, however you may consult any outside websites/textbooks/papers or freely available software that you wish. You must cite your sources/tools appropriately.

The final project will run in parallel with the second half of the course. A (simple) commercially available IC will be photographed at each layer and each team will be assigned a portion of the device to reverse engineer. Your goal is to generate a gate-level schematic of the circuit as well as a report describing any challenges you faced, the techniques you used, and a high-level description of what role your module plays in the functioning of the chip as a whole. Depending on enrollment, we may reverse the entire device or only a portion of it.

The policy on use of outside resources is the same as for homework.