Andrew "bunnie" Huang's IRIS Lets You Peer at Chips' Inner Workings with a Cheap Digital Camera

Andrew "bunnie" Huang has developed a technique for peering inside microchips that, unusually, doesn't involve destroying the device with acid or a grinder — and instead needs only off-the-shelf cameras and lenses with light modifications: infrared in-situ (IRIS) inspection.

"Cryptography tells us how to make a chain of trust rooted in special-purpose chips known as secure elements. But how do we come to trust our secure elements? I have been searching for solutions to this thorny supply chain problem," Huang explains. "Ideally, one can directly inspect the construction of a chip, but any viable inspection method must verify the construction of silicon chips after they have been integrated into finished products, without having to unmount or destroy the chips ('in situ'). The method should also ideally be cheap and simple enough for end users to access."

That's where IRIS comes in. The concept itself is simple, and based on two facts: silicon is transparent to infrared light, and standard digital cameras can be easily modified to capture images based on infrared illumination. Using these two facts, IRIS was born: shining a strong enough infrared light through a still-packaged chip and picking up its reflections with a modified digital camera.

Taking finished and packaged chips and investigating their inner workings is by no means a new concept, but previous approaches have tended towards the hands-on. Decapsulation typically involves removing a chip from its host device and boiling it in a strong acid to melt away the upper layers and expose the silicon beneath — followed by physical grinding to get to other layers, where required. "[IRIS] works even after the chip has been assembled into a finished product," Huang explains of what makes his approach different. "However, the resolution of the imaging method is limited to micron-scale features."

In IRIS, an infrared emitter which shines light at the 1,050nm spectrum is pointed at a packaged chip, still attached to its host circuit board. The light travels into the package and through the silicon, only reflecting when it hits the routing metal layer. As it reflects, it's picked up by an off-the-shelf digital camera with the infrared filter — whose job is to prevent infrared light from washing out color photographs — removed, which lets it capture the reflected infrared light and create an image of the chip's inner workings.

"[You can] modify an entry-level digital inspection camera, purchasable for about $180, to perform IRIS inspections," Huang explains. "The modification is fairly straightforward and takes just a few minutes. The result is an inspection system that is capable of performing, at the very least, block-level verification of a chip’s construction."

There is only one real catch, beyond the resolution of the technique lacking the ability to drill down into the micro scale required to see individual logic gate components: the infrared light has to be able to reach the silicon, which means IRIS only works with chips that have been packaged in such a way that the back side of the silicon is left exposed. "Fortunately," Huang says, "a fairly broad and popular range of packages such as WLCSP and FCBGA already expose the back side of chips."

Full details, including instructions on setting up your own IRIS capture system, are available on Huang's blog.