Laser Station 2

Introduction

Protecting chips against laser fault attacks is one of the main security challenges in the smart card industry. With the Laser Station 2, a user can perform advanced laser fault attacks that meet the highest international standards to assess if a smart card is secured against laser attacks.

The Laser Station 2 offers a set of new features meeting the latest timing and power requests from fault injection experts around the world. The special set of lasers with dedicated optics and the ultra-fast and flexible control create the ultimate fault injection test solution. Its integration with the Inspector software further ensures that automation and analysis are covered by extendible modules which are flexible and easy to use.

The Laser Station 2 contains powerful Red and NIR diode lasers (resp. 14W, 20W) out of the box. The red laser is designed for front- side testing of smart card chips and in combination with the optics it produces a spot size of 6 × 1.4 μm on the chip surface. This gives an accurate control over the chip area. The laser has sufficient power to penetrate through the gaps in the shielding commonly applied in today’s secure chips. The near-infrared laser is designed for back-side testing of smart card chips. This powerful diode laser penetrates the chip substrate to reach the transistors. Riscure partners with Opto (www.opto.de), a world-renowned optical design house in Germany, for the Laser Station 2. The optics and lasers of the system have been specifically designed to achieve the ultimate laser setup for fault injection testing.

Key features

Supports front and back-side attacks.

Automated Z-axis.

Fast and predictable response to trigger pulse.

Heavy stable base for high magnifications.

Spot sizes down to 1um.

Automatic scanning of a chip’s surface with integrated motorized XYZ stage.

Integration with Inspector’s software and fault analysis modules.

Fast multi-time glitching.

Camera inspection of laser spot and location on chip area.

Supports DPSS and Riscure/Alphanov modules.

Accurate digital scaling.

High repetition accuracy on motorized axes.

Blue, green, red and NIR laser sources available now.

Multi-spot upgrades available.

SDK available for integration into custom setups.

Zoomable camera for easy navigation.

IR navigation upgrade available.

FDA/CE approved safety enclosure.

How to use Laser Station 2

Multi glitching

Accurate timing is critical in fault injection testing. It is required when targeting specific program instructions and it saves testing time when investigating a specific weakness. The Laser Station 2 has a stable and very fast response to a trigger which enables any multi-glitching test scenario. The figure on the right shows an example of the laser response when multi glitching with the Laser Station 2 and the VC Glitcher or Spider. At the top graph, three trigger pulses are generated with different lengths and a shortest frequency of 250MHz / 2ns. The bottom graph shows that the laser responds to each trigger with a constant delay of 50 nanoseconds, and with the exact same interval as the trigger pulses.

Application

The Laser Station 2 is designed to test smart card chips of the latest generation. The tool has demonstrated to be very effective in testing hardware and software countermeasures in smart cards. It automates the surface scanning process, it offers fine control over the laser power, and it injects pulses with a small spot size. With the accurate and fast response to a trigger and with the ability to perform multi glitching, it is the ultimate fault injection test tool.

Adjusting power

Smart card chips differ and to identify a chip’s weakest spot, one has to be able to accurately adjust the strength of the laser pulse. When injecting too little energy, there is no effect, and when injecting too much energy, the so-called latchup effect occurs which causes chip damage. Only when injecting the right amount of energy, integrated circuitry can be effectively manipulated. With the Laser Station 2, a user can accurately tune the laser strength from the software to find a chip’s vulnerable energy level.

Inspector integration

The Laser Station 2 forms an integral part of the Inspector test tool. The VC Glitcher controls the timing and power settings of the diode laser pulse, and performs triggering, synchronous power measurements and card communication. The XY stage and camera connect to the Inspector FI software for navigation and automated surface scanning. The solution can further be extended with icWaves to trigger faults and to prevent a card from breaking down after a laser attack by triggering a cold reset on the VC Glitcher or Spider

Technical specifications

808nm red laser:

Purpose: Embedded Chips and Smart card chip frontside testing
Wavelength: 808 nm
Type: Multimode
Max laser pulse power: 14 W
Max pulse frequency: 25 MHz
Propagation delay: 50 ns
Spot size (50× objective): 6 × 1.4 μm
Diode life time: No degradation of laser power @ 3500 hrs continuous operation. In pulsed mode many more hours.
Laser controls: Analog input 0 – 3.3 V for power level, TTL input for laser modulation, laser diode current monitor output 20 A/V

1064nm NIR laser:

Purpose: Embedded chips and Smart card chip backside testing
Wavelength: 1064 nm
Type: Multimode
Max laser pulse power: 20 W
Max pulse frequency: 25 MHz
Propagation delay: 50 ns
Spot size (50× objective): 6 × 1.4 μm
Diode life time: No degradation of laser power @ 3500 hrs continuous operation. In pulsed mode many more hours.
Laser controls: Analog input 0 – 3.3 V for power level, TTL input for laser modulation, laser diode current monitor output 20 A/V

Other wavelengths and laser sources available

Microscope XY stage:

Max. travel range: 75 × 50 mm
Minimum step size: 0.05 μm
Accuracy: ± 3 μm
Repeatability: < 1 μm
Travel speed: 45 mm/sec
Controller interface: USB and joystick

Other stages available on request

Contact us
Bartek Gedrojc 大虎
Sales and Business Development Director Tools