Search

Laser Station 2: A Security Test Tool for Laser Attacks on Smartcards

Fast, accurate and predictable multi-in-time optical glitching for front side and back side laser attacks.

Download datasheet

Introduction

Protecting chips against laser fault attacks is one of the main security challenges in the smart card industry. With the Laser Station 2, a user can perform advanced laser fault attacks that meet the highest international standards to assess if a smart card is secured against laser attacks.

The Laser Station 2 offers a set of new features meeting the latest timing and power requests from fault injection experts around the world. The special set of lasers with dedicated optics and the ultra-fast and flexible control create the ultimate fault injection test solution. Its integration with the Inspector software further ensures that automation and analysis are covered by extendible modules which are flexible and easy to use.

The Laser Station 2 contains powerful Red and NIR diode lasers (resp. 14W, 20W) out of the box. The red laser is designed for front- side testing of smart card chips and in combination with the optics it produces a spot size of 6 × 1.4 μm on the chip surface. This gives an accurate control over the chip area. The laser has sufficient power to penetrate through the gaps in the shielding commonly applied in today’s secure chips. The near-infrared laser is designed for back-side testing of smart card chips. This powerful diode laser penetrates the chip substrate to reach the transistors. Riscure partners with Opto (www.opto.de), a world-renowned optical design house in Germany, for the Laser Station 2. The optics and lasers of the system have been specifically designed to achieve the ultimate laser setup for fault injection testing.

Key features

  • Supports front and back-side attacks.

  • Heavy stable base for high magnifications.

  • Integration with Inspector’s software and fault analysis modules.

  • Supports DPSS and Riscure/Alphanov modules.

  • Blue, green, red and NIR laser sources available now.

  • Zoomable camera for easy navigation.

  • Automated Z-axis.

  • Spot sizes down to 1um.

  • Fast multi-time glitching.

  • Accurate digital scaling.

  • Multi-spot upgrades available.

  • IR navigation upgrade available.

  • Fast and predictable response to trigger pulse.

  • Automatic scanning of a chip’s surface with integrated motorized XYZ stage.

  • Camera inspection of laser spot and location on chip area.

  • High repetition accuracy on motorized axes.

  • SDK available for integration into custom setups.

  • FDA/CE approved safety enclosure.

How to use Laser Station 2

Multi glitching

Accurate timing is critical in fault injection testing. It is required when targeting specific program instructions and it saves testing time when investigating a specific weakness. The Laser Station 2 has a stable and very fast response to a trigger which enables any multi-glitching test scenario. The figure on the right shows an example of the laser response when multi glitching with the Laser Station 2 and the VC Glitcher or Spider. At the top graph, three trigger pulses are generated with different lengths and a shortest frequency of 250MHz / 2ns. The bottom graph shows that the laser responds to each trigger with a constant delay of 50 nanoseconds, and with the exact same interval as the trigger pulses.

Application

The Laser Station 2 is designed to test smart card chips of the latest generation. The tool has demonstrated to be very effective in testing hardware and software countermeasures in smart cards. It automates the surface scanning process, it offers fine control over the laser power, and it injects pulses with a small spot size. With the accurate and fast response to a trigger and with the ability to perform multi glitching, it is the ultimate fault injection test tool.

Adjusting power

Smart card chips differ and to identify a chip’s weakest spot, one has to be able to accurately adjust the strength of the laser pulse. When injecting too little energy, there is no effect, and when injecting too much energy, the so-called latchup effect occurs which causes chip damage. Only when injecting the right amount of energy, integrated circuitry can be effectively manipulated. With the Laser Station 2, a user can accurately tune the laser strength from the software to find a chip’s vulnerable energy level.

Inspector integration

The Laser Station 2 forms an integral part of the Inspector test tool. The VC Glitcher controls the timing and power settings of the diode laser pulse, and performs triggering, synchronous power measurements and card communication. The XY stage and camera connect to the Inspector FI software for navigation and automated surface scanning. The solution can further be extended with icWaves to trigger faults and to prevent a card from breaking down after a laser attack by triggering a cold reset on the VC Glitcher or Spider

Technical specifications

808nm red laser:

  • Purpose: Embedded Chips and Smart card chip frontside testing
  • Wavelength: 808 nm
  • Type: Multimode
  • Max laser pulse power: 14 W
  • Max pulse frequency: 25 MHz
  • Propagation delay: 50 ns
  • Spot size (50× objective): 6 × 1.4 μm
  • Diode life time: No degradation of laser power @ 3500 hrs continuous operation. In pulsed mode many more hours.
  • Laser controls: Analog input 0 – 3.3 V for power level, TTL input for laser modulation, laser diode current monitor output 20 A/V

1064nm NIR laser:

  • Purpose: Embedded chips and Smart card chip backside testing
  • Wavelength: 1064 nm
  • Type: Multimode
  • Max laser pulse power: 20 W
  • Max pulse frequency: 25 MHz
  • Propagation delay: 50 ns
  • Spot size (50× objective): 6 × 1.4 μm
  • Diode life time: No degradation of laser power @ 3500 hrs continuous operation. In pulsed mode many more hours.
  • Laser controls: Analog input 0 – 3.3 V for power level, TTL input for laser modulation, laser diode current monitor output 20 A/V

Other wavelengths and laser sources available

Microscope XY stage:

  • Max. travel range: 75 × 50 mm
  • Minimum step size: 0.05 μm
  • Accuracy: ± 3 μm
  • Repeatability: < 1 μm
  • Travel speed: 45 mm/sec
  • Controller interface: USB and joystick

Other stages available on request

Contact us

Any questions? Feel free to contact me

  • Bartek Gedrojc 大虎
  • Sales and Business Development Director Tools
By continuing to browse this website, you agree to the use of cookies and data processing according to our privacy statement. Close