Accessories

Generating a trigger pulse at the right point in time is essential in fault injection (FI) and side channel analysis (SCA) testing, but clock jitter and random program interrupts make this difficult, resulting in inaccurate timing.

The DS1002A Pattern Based Trigger Generator solves this problem by generating a trigger pulse after detecting a pattern in the EM signal of a chip. A special narrow band-pass filter enables pattern detection even in noisy signals.

The DS1210A is a continuous-wave laser source with very precise power output. Use it for side-channel measurements based on failure analysis methodologies applied for side channel analysis.

• 1310 nm continuous-wave laser
• Single mode
• 500 mw
• Long-life laser diode for minimal aging
• Choose from coarse to detailed chip surface scanning with a 100:1 spot size range
• Use with DS1101A Fault Injection Laser System and DS1102A Dual Laser Fault Injection System
• Control optical power with DS1160A Smartcard Voltage and Clock Glitcher or DS1180A Glitch Pattern Generator

Injecting faults on an embedded device using power requires dedicated equipment. For a reliable glitch to be delivered to the target, the power supply needs to deliver sufficient power with minimal noise — and have sufficient power to generate steep voltage spikes. It is also necessary to monitor power consumption to identify areas of interest and see target behavior. The Keysight 30 A Amplifier combines these functionalities in one stand-alone component for targets consuming up to 10 A of current (peak-to-peak).

The DS1141A model provides the following features:

• Convenient add-on to Keysight’s Glitch Pattern Generator or Smartcard Voltage and Clock Glitcher to amplify the power glitches for an embedded processor
• Includes internal voltage and current monitor
• Includes two external power supplies

The High Precision Electromagnetic Probe, a highly sensitive probe used in side channel analysis, picks up electromagnetic emissions from semiconductor circuits. The probe has a mechanism that allows you to swap out three different probe tips of varying sizes: 0.2 mm, 0.5 mm, and 1.25 mm. All tips have a directed coil and a protective Teflon shell. Normally used in combination with an XYZ-motion platform, the probe can pick up electromagnetic fields with frequencies of up to 6 GHz, converting them into an AC signal.

By moving over the surface of a target, the DS1203A can find highly active circuits, or hotspots. The signals picked up on a hotspot comprise the measurements for simple or differential electromagnetic analysis. The High Precision Electromagnetic Probe has a variable gain mechanism, which you can set by hand or through an external device such as the Spider and can vary based on the target’s characteristics.

The 1.5 A Glitch Amplifier is designed to make your fault injection tests applicable to a wide range of embedded targets. Easily connect the 1.5 A Glitch Amplifier to the Spider or VC Glitcher to produce sharp and accurate glitches on the target and to an oscilloscope to measure and view the glitches that you generate.

Designed to drive the input pin of an embedded processor, the 1.5 A Glitch Amplifier has virtually 0 Ω output impedance. The DS1140A can operate as a single power supply between 0 and 4 volts (V). This voltage is set in Inspector and controlled via the Spider or VC Glitcher.

The 1.5 A Glitch Amplifier has an amplification factor of two. For example, when setting a continuous voltage level of 2 V and a glitch peak voltage of 3 V, the voltage levels between the Spider or VC Glitcher and the 1.5 A Glitch Amplifier are 1 and 1.5 V, respectively. Consequently, the voltage levels between DS1140A and an embedded processor are respectively 2 and 3 V.

• Increased glitch success rate due to sharper glitches
• Integrated current and power monitor
• Amplifies glitches produced by the Spider or VC Glitcher up to 1.5 A peak-to-peak
• Allows glitching embedded devices such as FPGAs and SOCs
• Easy connection to your target via one of the three output connectors that Glitch Amplifier II offers
• Easy to position closely above your target
• Includes Glitch Amplifier Needle
• Optional 3D positioner (for Glitch Amplifier Needle)
• Can be used in combination with EM probe station baseplate. Glitch Amplifier II exactly fits the baseplate’s grid.

The Active Current Probe is a high-frequency probe that actively picks up electrical currents. Used in side channel analysis to measure a target device’s power consumption, the highly sensitive DS1202A is inserted in the power supply line of a target and can transfer current variations of up to 2 GHz. The Active Current Probe is used in combination with a base unit, which can be used to amplify the measured signal.

• Bandwidth 1 MHz–2,000 MHz
• Maximum continuous current 100 mA (RMS) AC
• Maximum pulse current 5 A
• Current measurement circuit ≤ 0.082 Ω, ≤ 0.042 µH
• 40 dB of gain with base unit max

The Glitch Amplifier Needle allows you to glitch directly on the soldering pins of a chip, without having to cut the power line. The optional 3D positioner can be used to mount the needle and position it above the target.

The DS1322A is driven by the Glitch Amplifier and can insert high-speed glitches on embedded targets without having to use the Glitch Amplifier as a power supply for the target. By connecting the Glitch Amplifier “out” SMB to the Glitch Amplifier Needle, you can inject faults by placing the needle on the target VCC pin and connecting the ground clip to the target ground. The Glitch Amplifier Needle has a spring-loaded tip for easy positioning.

High Precision Fault Injection Probe Tips can provide a precise, local glitch using powerful electric magnetic pulses. Our unique production technique results in high precision tips featuring small coils, which produce a local glitch that, with multiple windings, still delivers enough power to drive successful fault injection attempts. Due to our smaller coils, the penetration depth of our High Precision Fault Injection Probe Tips is lower compared to larger probe tips, so that preparing, or decapping, the chip may be necessary.

• Reduces the area of impact for the injected fault, making it easier to analyze exactly which part of the chip is vulnerable
• Increases fault injection success rate
• Due to the tips’ high power, decapping a chip is not always required

Body bias injection (BBI) is a relatively new technique in fault injection which has been adopted by several security testing schemes. By extending the DS1120A or DS1120B Unidirectional Fault Injection Probe with the DS1320A Body Bias Injection Probe Needles, you can ensure that your chips are robust against this technique. A BBI probe injects faults in a very small location, allowing you to pinpoint security vulnerabilities to a more specific location.

• Get full BBI attack coverage in a dedicated package: forward (FBBI), reverse (RBBI), and large voltage range for attack scenarios on all chips
• Includes two FBBI and two RBBI probes in high and low voltage
• Prevent scratches on the substrate with spring-driven needles
• Penetrate thick substrates with a 200 V maximum output
• Easily connect to DS1120A or DS1120B Unidirectional Fault Injection Probe with an SMA connector

DS1020A Analysis Workstation is a standard PC workstation for the Inspector software package.

• 27” monitor
• 1 TB solid state drive (SSD) hard disk
• Windows 10
• 32 GB RAM

The Keysight glitch pattern generator provides a single control point to streamline and accelerate your fault injection testing. It also interacts with complex embedded targets—enabling you to execute functions, warm or cold resets, glitching, and program flow.

By creating glitch waves with any slope, the Keysight glitch pattern generator allows for very specific testing of embedded chipsets. Longer glitch waves with a specific slope often stretch the robustness of a chipset, but the glitch pattern generator creates custom glitch shapes that allow for adjusting the output voltage, timing, repetition rate and frequency, and duration of the pulse.

• Reduce set-up complexity in side channel analysis (SCA) and fault injection (FI) testing with a single control point that includes all input/output (I/O) and reset lines for custom or embedded interfaces.
• Generate arbitrary glitch waves with 4ns time resolution.
• Read and respond to signals associated with protocols like JTAG, I2C, and SPI.
• Control seamlessly, using the Inspector software or from a stand-alone device.
• Easily link an information channel to the internal processing state of the targeted hardware in your testing.
• Get started quickly with included example protocols.