efuse technical information

[aholmes187]

i just wanted to say that i find the efuse concept/working pretty intereasting and googling i found this.....

http://www.priorartdatabase.com/IPCOM/000139312/


"Efuse-based IC Security Scheme
This article describes a reversible system for disabling scan chain access to an integrated circuit after manufacturing test. By using on-chip electronically programmable fuses, access to scan chains, which are typically used for test purposes, can be first disabled, and later, if needed, re-enabled. For example, scan chains may be re-enabled to perform diagnostics. "

anyone think its worth the 40 bucks they want for the 3 pages? or has anyone allready read it? sorry if this seems like a repost....but tinkerer suggested that i start a new thread, he also found some neat information posted in the patents regarding the dubug part i believe. mabye some people with some superior knowledge would be intereasted anyways...

[aholmes187]

This is some more really intereasting (well i think it is anyway) its 3/4 of the way down, after fig. 13 titled "Test structure for electrically programmable fuse diagnostics"   yea your thinking oooo...pictures

http://www.research.ibm.com/journal/rd/504/ketchen.html

"As a possible solution to this characterization challenge, we have designed a test structure for in-line characterization of eFuse using parametric testers with only dc I/Os [13]. A key component of this test structure is the pulse generator. The pulse width required for this application is five orders of magnitude greater than what can be practically generated with the scheme shown in Figure 3(d). A simplified schematic diagram of the pulse generator circuit developed for this application is shown in Figure 14. A ring oscillator with 241 stages is enabled by setting the input ENABLE = “1” and serves as an on-chip clock. A “dc” Launch signal creates a sharp rising edge for the pulse and initiates a resettable counter. At a selectable time after the generation of the first pulse edge, a signal is sent to create the falling edge of the pulse. A latch, LatchA, is used for creating the rising edge of the pulse, as shown in Figure 3(c). With a “1” preloaded into the data port of LatchA (via input Arm) and with its output at “0,” all is quiet until the Launch input to the LatchA clock is of sufficient magnitude to allow the loaded “1” to pass to the output. The only requirement for the Launch input signal is that it must undergo a transition from “0” to “1” (the details of the waveform, including the duration of the transition, are unimportant). The output from LatchA is a very sharp edge that occurs at some point during the rise of the Launch signal, and subsequent events are self-timed with respect to this sharp edge. The LatchA output forms the leading edge of the pulse for the eFuse blow at the OUT terminal, preloads a “1” into the data port of LatchB, and also turns off the reset signal (r) to the resettable counter. The counter counts up to a specific time determined by the decoder inputs a1 and a2, and then sends a signal to the clock input of LatchB, which is waiting with the preloaded “1.” Next, the output from LatchB is inverted and combined with the original LatchB output to form the falling edge of the pulse, which appears at the OUT terminal and is applied across the fuse. The resistance of the fuse is measured before and after the application of the pulse to quantify the performance of the eFuse structure. Table 1 gives an example of output pulse widths for various decoder inputs."

[aholmes187]

sorry for the long winded post above, and posting again but this is more info ive found pertaining to efuses. some are presentations or technical papers.

http://domino.research.ibm.com/comm/research_projects.nsf/pages/sixthsense.pubs.html/$FILE/pervasive_fmcad06.pdf

http://www.priorartdatabase.com/IPCOM/000139312/

http://www.research.ibm.com/journal/rd/504/ketchen.pdf

http://www.paritycomputing.com/jpdfs/ieee/ssc/jssc/2005040/01jan/0213bart.pdf

[tinkerer15khz]

nice link aholmes

http://www.chipdesignmag.com/display.php?articleId=536

"Another efuse disadvantage is that it can be easily reverse engineered by high-magnification visual inspection of the silicon, which compromises key security."

[probutus]

this would mean that the guys who decapped the CPU before could have a look with a microscope

[speedy22]

Yes  a decapping CPU was inspected with a SEM (scanning electron microscope) the problem is the efuses are located beneath the metal layers of the silicon. This means the various layers would need to be removed in stages. It is possible but very expensive and out of range for the weekend hobbist.

Here is some more info. This is a scary document.

http://www.freshpatents.com/Using-electrically-programmable-fuses-to-hide-architecture-prevent-reverse-engineering-and-make-a-device-inoperable-dt20060622ptan20060136751.php

This IEEE document explains efuses.
Electrically Programmable Fuse (eFUSE) Using Electromigration in Silicides
C. Kothandaraman, Sundar K. Iyer, Member, IEEE, and Subramanian S. Iyer, Fellow, IEEE

S22

[speedy22]

Here's the patent in a PDF.

http://www.pat2pdf.org/patents/pat20060136751.pdf

S22

[Tiros]

This means the various layers would need to be removed in stages. It is possible but very expensive and out of range for the weekend hobbist.

I read quite a while back that those fuses are underneath metal for a reason. IIRC it was stated that removing those layers would render the chip inoperaple. Since the efuse config of each console is unique, even if you optically inspected, you would wind up with the key only for a dead unit.

[aholmes187]

speedy22....niice find on the pdf, haha gotta love diagrams.
@ tiros.....yes i do remember  now that you bring it up about having to remove a layer at a time leaving it inoperable which is a shame. i wasnt trying to be like oooo efuse is the golden ticket. i just find the whole concept really cool.
Is there anyone in the medical field on here? i wonder if with the advancements in medical imaging it would be possible to image the chip with out destroying most of it?  i wasnt really trying to say that visually inspecting them is a good choice, because after all trying to make some kind of useable diagram after visually inspecting like 2000? efuses...hahaha probably not that much fun

[tinkerer15khz]

While you would end up with a dead unit do you think part of the efuses would be the same across all 360s? Where is the initial bootcode for system in southbridge or in the cpu. If in cpu in efuse form wouldnt that code be the same for all boxes and the begining of each start up is unencrypted till it loads the decrypter for the boot loader right? If someone had some flashing red lights xboxes would could decap and get that second layer of metal off possibly.

[tinkerer15khz]

pictures of efuses

efuses highlighted

http://www.realworldtech.com/includes/images/News/ppc970mp-1.gif

and

chip with efuses no highlights

http://www-03.ibm.com/chips/photolibrary/photo10.nsf/WebViewNumber/F15EA05B26454BE885256F9C0070FE3A

"To download the full resolution image: Right click on the image below and select "Save Image As". You will be prompted to select the directory on your hard drive." Image is 1.1mb

[tinkerer15khz]

A search for patents with jtag AND fuse AND "international business machines"

http://appft1.uspto.gov/netacgi/nph-Parser?Sect1=PTO2&Sect2=HITOFF&u=%2Fnetahtml%2FPTO%2Fsearch-adv.html&r=0&p=1&f=S&l=50&Query=jtag+AND+fuse+AND+%22international+business+machines%22%0D%0A%0D%0A&d=PG01

1    20060136858    Utilizing fuses to store control parameters for external system components
2    20060136751    Using electrically programmable fuses to hide architecture, prevent reverse engineering, and make a device inoperable
3    20060131743    Changing chip function based on fuse states
4    20050242924    Method and apparatus for resisting hardware hacking through internal register interface
5    20050010788    System and method for authenticating software using protected master key
from patent #5 "3. The method of claim 2 wherein the loading is performed by a processor and wherein the processor and the second memory area are located in a common semiconductor package. "
6    20050010767    System and method for authenticating software using hidden intermediate keys
7    20040263199    ADAPTIVE INTEGRATED CIRCUIT BASED ON TRANSISTOR CURRENT MEASUREMENTS
8    20020123854    JTAG-based software to perform cumulative array repair
9    20020069386    Joint test action group (JTAG) tester, such as to test integrated circuits in parallel