A Zazunov

R Egger

C Mora

T Martin

Superconducting transport through a vibrating molecule

Keywords: numbers: 74.78.Na, 74.45.+c, 74.50.+r

Nonequilibrium electronic transport through a molecular level weakly coupled to a single coherent phonon/vibration mode has been studied for superconducting leads. The Keldysh Green function formalism is used to compute the current for the entire bias voltage range. In the subgap regime, Multiple Andreev Reflection (MAR) processes accompanied by phonon emission cause rich structure near the onset of MAR channels, including an even-odd parity effect that can be interpreted in terms of an inelastic MAR ladder picture. Thereby we establish a connection between the Keldysh formalism and the Landauer scattering approach for inelastic MAR.

I. INTRODUCTION

One of the primary goals in the field of molecular electronics is to understand quantum transport through individual nanoscale objects, such as molecules, short carbon nanotubes, or DNA; for reviews, see Refs. [1,[START_REF]Introducing Molecular Electronics[END_REF]3]. An important difference to conventional mesoscopic transport through quantum dots or granular islands arises because molecules can have intrinsic vibrational degrees of freedom ('phonons') that may give rise to Franck-Condon sidebands or phonon blockade in electronic transport. Such features have been studied theoretically in many recent papers [4,5,6,7,8]. Molecular electronics is particularly exciting because it is in principle possible to contact molecules by leads of different nature. Here we discuss how nonequilibrium transport is affected by a coherent phonon mode coupled to the molecular charge for the case of (s-wave BCS) superconducting leads. Molecules connected to superconductors promise a rich terrain of exploration that allows for new spectroscopic tools (probing molecular properties), potentially useful applications, and interesting fundamental physics. First experimental results have appeared for carbon nanotubes [9,10,11,12,13] and metallofullerenes [14].

So far transport through molecules has been theoretically studied only for normal leads, either using rate equations or (in the quantum-coherent regime) perturbation theory in the electron-phonon coupling λ [7]. For superconducting leads and large transmission through the molecule, subgap transport is ruled by MAR processes [15,16]. These have been extensively studied for point contacts [17,18,19] and for junctions containing a resonant level [20,21]. In this paper, we provide a theoretical framework to include vibrations into superconducting transport through a resonant molecular level. We focus on the most interesting quantum-coherent low temperature (T ) limit with high (bare) transmission, where Coulomb charging effects are largely wiped out. Therefore the Coulomb interaction on the molecule will be neglected here. We compute the d.c. current basically for the full bias (V ) range within a Keldysh Green function scheme valid for small λ but arbitrary phonon frequency ω 0 . This approximation is current-conserving for identical molecule-lead couplings Γ L = Γ R = Γ and superconductor gaps ∆ L = ∆ R = ∆.

Our main results are as follows. (i) For eV ≫ ∆, the coupling λ tends to enhance the excess current I exc , which is defined as the difference in current for V → ∞ when changing normal into superconducting leads. (ii) In the subgap regime eV < 2∆, the phonon gives rise to a quite complicated structure in the I-V characteristics around each MAR onset at eV = 2∆/n (integer n), with a pronounced even-odd parity dependence. These results can be qualitatively understood within a MAR ladder picture. Such a picture has previously been used for junctions with a resonant level [21] and is here extended to include phonon-induced transitions (inelastic MAR). Rich features in the I-V curve appear already for eV ≪ ω 0 , in contrast to normal leads where phonon signatures (e.g. sidebands) emerge only at eV ≥ ω 0 [5,7]. (iii) For V = 0, we give analytical results for the Josephson current in the adiabatic limit, ω 0 ≪ ∆ ≪ Γ. We find a reduction (but no destruction) of the critical current and a changed current-phase relation. These findings are in qualitative agreement with Ref. [22], where the opposite limit Γ ≪ ∆ has been studied by lowest-order perturbation theory in the lead-molecule hopping.

The outline of the paper is as follows. In Sec. II, we discuss the model and the Keldysh Green function approach taken in this work. In Sec. III, we present our results and provide a physical interpretation in terms of a MAR ladder picture. How such a scattering-type approach can be connected to the Keldysh approach is explained in detail in the Appendix. Finally, some conclusions are offered in Sec. IV. We put e = = 1 in intermediate steps.

II. MODEL AND KELDYSH APPROACH

A. Model

We now wish to formulate and analyze a tractable model describing the relevant physics of a molecule sandwiched between superconducting leads. Writing the Hamiltonian as

H = ω 0 b † b + σ (ǫ 0 + λX)d † σ d σ + H L + H R + H T , (1)
we consider one relevant molecular level associated with the fermion operator d σ for spin σ =↑, ↓ and located at the energy ǫ 0 . In Eq. ( 1) we take a linear coupling between the molecular charge and the phonon displacement X = b + b † , where the boson operator b annihilates a phonon excitation. For a justification of this form and possible other couplings, see Ref. [5]. The leads are described by a pair of standard s-wave BCS Hamiltonians.

Using the Nambu vector Ψ T j,k = (ψ j,k,↑ , ψ † j,-k,↓ ) for electrons in lead j = L/R, we have

H j=L/R = k Ψ † jk ξ k ∆ ∆ * -ξ k Ψ jk (2)
with single-particle energy ξ k = k 2 /2m -ǫ F ; the 2 × 2 matrix acts in Nambu space. In the following, standard Pauli matrices in Nambu space are used and denoted by σ x,y,z . Using the Nambu vector d = (d ↑ , d † ↓ ) T and Γ = πν 0 |t 0 | 2 for (normal) lead density of states ν 0 , the lead-molecule coupling is

H T = t 0 k,j=L/R=± Ψ † jk σ z e ±iσz V t/2 d + h.c., (3)
where the voltage V enters via the time-dependent phase.

As we are mostly interested in the V = 0 case, for simplicity, we consider ∆ > 0 to be real-valued. (In the study of the Josephson current, the residual V = 0 phase difference across the molecule is of course taken into account.) Note that Eqs. ( 2) and (3) assume symmetric coupling and identical superconducting gaps. Our approximation scheme below will yield a current-conservating result only then. In fact, since the calculation of MAR-dominated transport is already involved for λ = 0, a nontrivial current-conserving self-consistent approach covering the large transmission limit seems out of question. Note that self-consistency is (usually) sufficient to ensure current conservation [23]. Below we instead proceed using a perturbation theory with the small expansion parameter λ/Γ. Under such an approach, current conservation is known to only hold for the electron-hole symmetric case [24], i.e., ǫ 0 = 0, with symmetrically arranged leads (∆ L = ∆ R = ∆, Γ L = Γ R = Γ). This case is taken in what follows. We note in passing that this important issue (and also the tadpole diagram in Fig. 1) was overlooked in Ref. [7], where the same approximation as ours was implemented for normal leads but also used for asymmetric cases.

B. Keldysh approach

To compute the current-voltage characteristics, we now employ the Keldysh Green function technique. This method has become a standard approach by now; for a review, see, e.g., Ref. [START_REF] Kamenev | Nanophysics: Coherence and Transport Les Houches session LXXXI[END_REF]. The Keldysh Green function for the d fermion is defined as

G ss ′ αα ′ (t, t ′ ) = -i TC [d α (t s )d † α ′ (t ′ s ′ )] , (4)
where α, α ′ (s, s ′ = ±) are Nambu (Keldysh) indices, and TC is the time-ordering operator along the familiar Keldysh contour C [START_REF] Kamenev | Nanophysics: Coherence and Transport Les Houches session LXXXI[END_REF]. Accordingly, t s denotes a time taken on branch s of the Keldysh contour. Similarly, we define a phonon Keldysh Green function D ss ′ (t, t ′ ) for the quantity X = b + b † coupling to the fermion d in Eq. (1).

In what follows, we use the check notation ( Ǧ) in order to schematically indicate the Keldysh structure. In the case of electron Green functions, this also includes the Nambu structure. Denoting the respective functions for λ = 0 by Ǧ0 and Ď0 , and using the self-energy diagrams in Fig. 1, the dressed Green functions used in our perturbative approximation follow from the Dyson equation.

As we consider only the case ǫ 0 = 0, it can be checked that the 'tadpole' diagram does not contribute.

For the superconducting problem of interest here, it is convenient to use the double Fourier representation

Ǧ(t, t ′ ) = +∞ n,m=-∞ F dω 2π e -iωnt+iωmt ′ Ǧnm (ω), (5)
and likewise for all other Green functions and self energies. Here we use

ω n = ω + nV (6)
for ω within the 'fundamental' domain F defined as

F ≡ [-V /2, V /2]. (7)
For fixed ω ∈ F , the Dyson equations then lead to the matrix equations

Ǧ-1 0,nm (ω) = δ nm ω n τz -Γ j=L/R γj,nm (ω) (8) Ǧ-1 = Ǧ-1 0 -Σ, Ď-1 = Ď-1 0 -Π, (9)
where the Pauli matrix τz acts in Keldysh space, and

Ď-1 0,nm (ω) = δ nm τz ω 2 n -ω 2 0 2ω 0 . ( 10
)
The self energy due to tracing out the respective lead is given by the Nambu matrix γj=L/R=±,nm (ω) = ( 11)

δ nm X(ω n ∓ V /2) δ m,n∓1 Y (ω n ∓ V /2) δ m,n±1 Y (ω n ± V /2) δ nm X(ω n ± V /2)
with Keldysh matrices Y (ω) = -∆ X(ω)/ω and

X(ω) =    -ω √ ∆ 2 -ω 2 τz , |ω| < ∆ i|ω| √ ω 2 -∆ 2 2f ω -1 -2f ω 2f -ω 2f ω -1 , |ω| > ∆ where f ω = 1/(1 + e ω/kB T ) is the Fermi function.
Figure 1 yields for the polarization Π and the self energy Σ the following explicit expressions:

Πss ′ nm (ω) = -iλ 2 tr n ′ m ′ F dω ′ 2π τK Ǧ0;n ′ m ′ (ω ′ )τ K ss ′ × Ǧs ′ s 0;m ′ -m,n ′ -n (ω ′ -ω), (12)
Σss ′ nm (ω) = iλ 2 n ′ m ′ F dω ′ 2π D ss ′ n-n ′ ,m-m ′ (ω -ω ′ ) × τK Ǧ0;n ′ m ′ (ω ′ )τ K ss ′ , (13)
where 'tr' extends over Nambu space only and τK = τz σ z . Should the difference ω -ω ′ appearing in Eqs. ( 12) and ( 13) fall outside the fundamental domain F , one has to fold it back to F . This is implicitly understood in the above equations. The steady-state d.c. current through the left/right junction then follows in the form

I L/R = ∓2Γ Re nm F dω 2π tr σ z γL/R,nm (ω) Ǧmn (ω) +-. (14)
This relation constitutes a generalization of the Meir-Wingreen formula [START_REF] Meir | [END_REF] to the case of superconducting leads. We also define the phonon contribution

δI ph ≡ I(λ) -I(λ = 0). ( 15
)
Current conservation, I L = I R ≡ I, can be explicitly verified as follows. In the particle-hole symmetric case, current conservation requires that

Ǧss ′ nm (ω) = -σ z Ǧs ′ s mn (-ω)σ z . ( 16
)
This relation is indeed obeyed since the approximate Σ in Eq. ( 13) also fulfills Eq. ( 16).

Using Eq. ( 14), we evaluate the I-V characteristics for λ = 0.15Γ (unless noted otherwise) and k B T /∆ = 0.01. We truncate the summations such that |ω n | < ω c = 20∆; further increase of the bandwidth ω c did not change results. In practice, the domain F in Eq. ( 7) must be discretized. Typically, we found δω = 0.008∆ to be sufficient for convergence. The matrix inversions in Eqs. ( 8) and ( 9) are then done for each ω ∈ F separately, involving matrix dimensions of the order ω c /eV . For very small eV /∆, this becomes quite costly, and we limit ourselves to eV /∆ > 0.15 in the following.

Fortunately, there are several nontrivial tests that we can use to check the scheme. For λ = 0, our approach quantitatively reproduces the results of Refs. [17,19,21]. For ∆ = 0, we recover results of Ref. [7] when applicable (i.e., for ǫ 0 = 0). As additional check, Green function sum rules [START_REF] Kamenev | Nanophysics: Coherence and Transport Les Houches session LXXXI[END_REF] were verified, such as tr τ K Ǧ(t, t) = 0 (17) at coinciding times. While such relations must hold for the exact Green function, it is reassuring to verify that our approximation does not lead to violations of sum rules.

Besides the current, we have also monitored the average phonon number N ph = b † b and the frequencydependent phonon distribution function. We find N ph 1 for λ/Γ = 0.15, in accordance with our assumption of weak electron-phonon coupling. The phonon distribution function revealed renormalizations of the peak position away from ω 0 by a few percent.

To conclude this section, we note that it is possible to establish a close connection between this Keldysh Green function approach and a Landauer scattering approach incorporating inelastic transitions. Such an 'inelastic MAR' picture will in fact be essential in interpreting our numerical results in Sec. III A. This connection is detailed in the Appendix.

III. RESULTS

A. Subgap regime: Inelastic MAR

Let us then turn to results for the I-V curve. We start with the subgap regime, where MAR provides the dominant transport mechanism. In particular, for 2∆/(n + 1) < eV < 2∆/n (n integer), there is a total number n of Andreev reflections for electrons or holes within the superconducting gap. The I-V curve for Γ = 2∆ and ω 0 = 0.2∆ is given in Fig. 2, where δI ph is always negative. Note that in this fully transmitting limit, the I-V curve for λ = 0 is smooth and does not exhibit the MAR 'cusps' encountered at lower transmission [17]. Phonons now restore such features near MAR onsets, with pronounced even-odd 'parity' effects: For even (odd) n, δI ph shows valleys (peaks) around eV = 2∆/n. This is clearly seen in the left inset of Fig. 2 for n up to 12 [27]. Note that the dip at n = 8 is somewhat shifted, presumably due to phonon renormalization effects. However, the appearance of even-odd parity oscillations is quite distinct and surprisingly regular given the complexity of this system. In order to achieve a physical understanding of this even-odd effect, it is useful to invoke a MAR ladder picture in energy space, including inelastic transitions caused by phonon emission. A schematic description of the MAR ladder picture in this limit is given in Fig. 3. Superconductor spectra are placed next to each other, but because of the presence of the bias, electrons emitted from left to right gain an energy eV in this process. Holes that are reflected, traveling from right to left, also gain this energy.

Usually the scattering approach is used to develop this picture [21], but its straightforward implementation encounters conceptual difficulties in the presence of inelastic phonon transitions. Fortunately, a different route resolving these difficulties can be formulated via the above Keldysh approach, whose formal justification is detailed in the Appendix. Here electron and hole propagators in energy space are coupled to each other through suitable Andreev reflection matching conditions and the phonon self energy Σ. For a qualitative explanation of the evenodd effect found in the full calculation, cp. Fig. 2, it is sufficient to restrict the full MAR ladder picture to single phonon emission processes, where electrons (holes) lose (gain) the energy ω 0 . Since N ph 1, emission dominates over absorption and multi-phonon processes are rare.

In Fig. 3, the two superconductors are positioned at the same chemical potential, but electrons (from left to right) and holes (from right to left) 'climb' the MAR ladder by gaining eV for each Andreev reflection. The higher the total number of Andreev reflections in one cycle, the larger the total charge transmitted. Since we consider the high transmission limit where high-order MAR processes are not penalized, the current is therefore expected to increase (decrease) if phonon emission is able to increase (decrease) the number of Andreev reflections in a MAR cycle. For eV slightly below 2∆/n with even n, we then argue as follows; for n = 2, see Fig. 3. For small energy transfer ω 0 , if a phonon is emitted during an electron segment, MAR trajectories in energy space are not drastically modified in the sense that the number of Andreev reflections stays unaffected. However, if a phonon transition occurs during a hole segment, the MAR ladder is shifted upwards by ω 0 and the last hole on the MAR ladder can be scattered into the continuum (left electrode in Fig. 3) instead of being Andreev reflected. Consequently, one Andreev reflection is lost and hence the current is expected to decrease. This argument applies both to incoming electrons and holes, and explains why current valleys are observed for eV ≈ 2∆/n with even n in Fig. 2. On the other hand, consider eV slightly above 2∆/n with odd n. Reiterating the above analysis, now phonon emission during a hole segment tends not to affect the number of Andreev reflections. If the phonon is emitted during an electron segment, however, an additional Andreev reflection has to take place to complete the MAR cycle, leading to a current peak for eV ≈ 2∆/n with odd n.

Next consider ω 0 = 1.8∆ but otherwise identical parameters, see Fig. 4, where δI ph can be positive and again shows oscillations near the MAR onsets, which are less pronounced for small n = 2∆/eV . Remarkably, even for small voltages, eV ≪ ω 0 , a rather complicated subgap structure is caused by the phonon. At such low voltages, this is only possible via MAR, for otherwise electrons or holes do not have enough energy to emit a phonon. The broad minimum corresponding to n = 2 observed in Fig. 2 has now vanished. Let us invoke the MAR ladder picture to rationalize this effect. For eV ∆, by emitting a high-energy phonon ( ω 0 > ∆), the last electron on the MAR ladder can now be scattered back inside the gap instead of heading to the continuum. This increases the number of reflections and thus the current. As a phonon emitted during the hole segment has the opposite effect (see above), the net outcome of the higher phonon frequency is to suppress the valley at eV ≈ ∆ expected for small ω 0 . Figure 4 also shows a dip in the current at eV ≈ 1.8∆, representing a phonon backscattering feature at eV = ω 0 . The scaling of this dip with ω 0 was confirmed by additional calculations. One can also see a two-phonon feature at eV = ω 0 /2 in Fig. 4.

Let us then briefly go back to ω 0 = 0.2∆ (cp. Fig. 2), but now for Γ = 0.5∆, see Fig. 5. For small Γ, quasiresonances appear [21] and cause additional features, e.g. negative differential conductance portions in the I-V curve. The MAR ladder picture then has to include both quasi-resonances (cp. Ref. [21]) and phonon transitions, which is possible but beyond the scope of this paper. Fig. 5 shows that the even-odd parity effect requires large Γ to be observable.

B. Excess and Josephson current

Finally, we briefly discuss the limits of very large and/or zero voltage. Starting with the first case (excess current), we have computed the difference δI exc,ph between the excess currents I exc with and without the phonon. This calculation has been done at eV = 10∆, which according to the discussion in Ref. [21] is certainly large enough for our parameters. For the case of high transmission encountered here, we find that phonons generally enhance the excess current. To give a concrete example, for ω 0 = 0.8∆, Γ = 2∆ and λ = 0.5∆, we find δI exc,ph /I exc ≈ 0.07. A similar current enhancement at high transmission was also found for environmental Coulomb blockade in superconducting junctions, and has been explained as 'antiblockade' effect [28]. As such, this effect of the phonon may not be too surprising.

Second, the equilibrium Josephson current has been calculated by adopting our approach to the Matsubara representation. For arbitrary parameters, it is straightforward to numerically compute the full current-phase relation. However, the current-phase relation in the adiabatic phonon regime defined by

ω 0 ≪ ∆ ≪ Γ (18)
can even be calculated analytically, with the result

I(φ) = (e∆ 2 /2 ) T 0 sin(φ)/E 0 (φ), (19)
where

E 0 (φ) = ∆[1 -T 0 sin 2 (φ/2)] 1/2 (20)
is an Andreev bound state energy [17] in the junction with an effective transparency

T 0 = 1 1 + λ 2 /4Γ 2 . (21)
The φ-dependent shift without any broadening of the Andreev level caused by the coupling to a phonon mode is characteristic for the coherent limit and decreases the critical current. Very similar results were reported in Ref. [22] in the opposite limit Γ ≪ ∆.

IV. CONCLUSIONS

In this work, we have for the first time theoretically explored nonequilibrium molecular transport with superconducting leads in the coherent phonon regime. Phonons reveal a rich subgap structure even for voltages well below the phonon frequency, including a surprising even-odd parity effect near the MAR onsets. This effect can be largely understood within a physically appealing inelastic MAR ladder picture, based on the assumption that single phonon emission processes dominate. For stronger electron-phonon couplings, also multiple phonon processes and/or absorption becomes important, and the practical usefulness of such a scattering approach is less clear, although it can be formally derived as outlined in the Appendix.

Let us also offer a brief outlook. Besides the obvious interest to experimentally probe the effects predicted here, the problems raised above deserve further theoretical work. In the case of strong electron-phonon coupling, different approximations will be necessary. Moreover, other quantities such as shot noise or frequencydependent noise [29] deserve attention. Noise can yield information about the effective charge involved in the transfer process, and how this charge is affected by phonon transitions remains to be explored. It would also be interesting to formalize the notion of inelastic MAR spectroscopy, potentially allowing to infer the electronic structure of molecules from the superconducting currentvoltage characteristics. Such approaches have already been very useful in nanoscale break junctions, and are of obvious interest in the molecular electronics context as well. It is safe to conclude that superconducting molecular transport definitely warrants further surprises in the future.

INELASTIC MAR: SCATTERING APPROACH

In this appendix, we outline the derivation of the Landauer scattering approach to inelastic MAR incorporating phonon transitions. Such an approach is formulated here using the equation-of-motion method, where transfer matrices are expressed in terms of Keldysh Green functions. This provides a formal justification for the intuitive MAR ladder picture used in Sec. III A.

Using the Hamiltonian (1), we can write down the equations of motion for the quasiclassical envelope function Ψ (r) j,k describing right/left-moving quasiparticles (r = ±) in the left or right lead (j = L/R = ±) with momentum rk F + k. Here |k| ≪ k F is assumed, and with the Fermi velocity v F , we obtain

(i∂ t -rkv F σ z -∆σ x )Ψ (r) j=±,k (t) = t 0 σ z e ±iσz V t/2 d(t). (22)
Similarly, the equation of motion for the molecular fermion (Nambu spinor d) is (23) where Ψ

(i∂ t -λX(t)σ z )d(t) = t 0 σ z j=±,r e ∓iσz V t/2 Ψ (r) j (t),
(r) j ≡ k Ψ (r)
jk . Here we consider the simplest possible situation, where phonon renormalization effects like the polarization bubble in Fig. 1 are completely disregarded. In that case it is sufficient to simply take an equilibrium average over the phonon subsystem, while otherwise one should also take into account the equation of motion for X(t).

The solution of Eq. ( 22), adapted to Ψ (r) j (t), can be written as the sum of a free (homogeneous) solution Ψ (r) j0 (t), describing an incoming quasiparticle in lead j = L/R, plus a scattered part due to the interaction with the molecular level, Ψ (r)

j (t) = Ψ (r) j0 (t) + t 0 dt ′ g (r) j (t -t ′ ) ( 24
)
×σ z e ±iσz V t ′ /2 d(t ′ ), which is expressed in terms of the retarded Green function g (r) j

for uncoupled electrodes whose Fourier transform is given by g

(±) L (ω) = g (∓) R (ω) = πν 0 2i ω + ∆σ x (ω + i0) 2 -∆ 2 ∓ σ z .
When summed over r, this essentially yields the retarded components of γj in Sec. II.

In what follows, we use s = {1, 2, 3, 4} in order to label scattering processes corresponding to electron-or hole-like quasiparticles incoming from the left (s = 1, 2) or right (s = 3, 4) electrode. In Fourier representation, where E is the energy of the incoming quasiparticle (|E| > ∆) and E n = E + nV , we write Ψ .

These spinors are defined on a chiral space, with the two entries corresponding to the right-and left-moving parts. From Eq. ( 24), we proceed to derive a first set of Andreev reflection matching equations for Φ e,h jn ,

Φ e Ln = a n 0 0 a -1 n Φ h Ln + δ n0 (u 2 E -v 2 E ) δ s1 /u E -δ s2 /v E Φ e Rn = a -1 n 0 0 a n Φ h Rn + δ n0 (u 2 E -v 2 E ) -δ s4 /v E δ s3 /u E ,
where a n = (E n -(E n + i0) 2 -∆ 2 )/∆. Furthermore, the u E , v E denote the n = 0 entries in Eq. [START_REF] Kamenev | Nanophysics: Coherence and Transport Les Houches session LXXXI[END_REF]. Note that these matching equations are not modified by the presence of phonons, see Ref. [30].

Iterating Eq. ( 23) and averaging over the phonons, we find (i∂ t -Σ) • d = t 0 σ z j=±,r e ∓iσz V t/2 Ψ (r) j (t), [START_REF] Meir | [END_REF] where • is a shorthand for convolution. The phonon self energy entering Eq. ( 26) is given by Σ(t, t ′ ) = iλ 2 D > 0 (t, t ′ )σ z G R 0 (t, t ′ )σ z .

Note that this ignores the polarization-bubble renormalization, see above. For the four different scattering processes indexed by s, it is convenient to introduce matrices Σnm according to Σ(t, t ′ ) = e iσz σstV /2 σ z Σ(t, t ′ ) σ z e -iσz σst ′ V /2 ≡ nm F dω 2π e -iωnt+iωmt ′ Σnm (ω) (28) with σ s = 1 (σ s = -1) for s ∈ {1, 2} (s ∈ {3, 4}). To keep the notation simple, the s-dependence of Σnm is not exhibited explicitly. Using Eq. ( 26), we then obtain a second set of matching equations. For s = {1, 2}, Φ e R,n+1 = (T where the Pauli matrices τ y,z operate in the space of the Φ e,h spinors and the α indices in Σαα ′ refer to Nambu space. Note again that these quantities all carry an implicit s-dependence.

Finally, after straightforward but somewhat tedious algebra, the d.c. current is expressed in terms of the above scattering states, Similarly, the full Keldysh Green function Ǧ can also be constructed from the complete set of scattering states Φ e,h jn (E).

I = ev F |E|>∆ dE |E| √ E 2 -∆ 2 f E 4 s=1 n (31)

FIG. 1 :

 1 FIG. 1: Self energy due to the presence of the phonon mode: (a) 'Fock' and (b) 'tadpole' diagram. The polarization bubble (c) leads to the dressed phonon propagator Ď (wiggly lines). Arrowed lines denote Ǧ0.

FIG. 2 :

 2 FIG. 2: Phonon difference current (15) for ω0 = 0.2∆ and Γ = 2∆. In all figures, currents are given in units of e∆/(2π ), and dotted lines are guides to the eye only. Left inset: Same as function of 2∆/eV . Right inset: Part of the total I-V curve (note the scales).

FIG. 3 :FIG. 4 :

 34 FIG.3: MAR ladder picture with phonon emission. Here eV is slightly below ∆: for an electron incoming from the left side, we have one hole (open circle) and two electron (filled circle) segments. Dashed lines indicate possible trajectories after single phonon emission involving either hole or electron segments. There is also a MAR path (not shown) for a hole entering from the right side, with one electron and two hole segments.

FIG. 5 :

 5 FIG.5: Same as Fig.2but for Γ = 0.5∆. The left inset gives δI ph versus 2∆/eV , the right inset the total current.

×

  a=e/h(δ s1 + δ s2 )Φ a † Rn (E) τ z Φ a Rn (E) + (δ s3 + δ s4 )Φ a † Ln (E) τ z Φ aLn (E) .

  = E + (n ± 1/2)V . Furthermore, transfer matrices linked to phonon-induced transitions are given in terms of the phonon self-energy matrix elements introduced in Eq.(28)

						with
						t e/h n	= -1/(1 ∓ iE e/h n /2Γ), r e/h n /t e/h n	= ±iE e/h n /2Γ,
						where E n e/h
							S ee S eh S he S hh	nm	=	iσ s 2Γ	(τ z -iτ y )	(30)
							×	-Σ11 (E) Σ12 (E) -Σ21 (E) Σ22 (E) nm	,
	e n ) -1 Φ e Ln +	S ee nm Φ e Lm + S eh nm Φ h Lm
			m
	Φ h R,n-1 = T h n	-1 Φ h Ln +	S hh nm Φ h Lm + S he nm Φ e Lm ,
			m
	while for s = {3, 4},
	Φ e L,n-1 = T e n-1 Φ e Rn +	S ee nm Φ e Rm + S eh nm Φ h Rm
			m
	Φ h L,n+1 = T h n+1 Φ h Rn +	S hh nm Φ h Rm + S he nm Φ e Rm .
			m
	Here, electron/hole transfer matrices are given by
	T e/h n	=	1/t e/h n /t e/h n r e/h n	r n /t e/h 1/t n e/h * e/h n	*	(29)

Acknowledgments

We thank K. Flensberg, A. Levy-Yeyati, and V. Shumeiko for useful discussions. R.E. and C.M. are grateful to the CPT for hospitality. R.E. was supported by the CNRS, the ESF network INSTANS, and by the EU networks HYSWITCH and DIENOW. T.M. acknowledges support from an A.C. Nanoscience from CNRS.


Sara Faour

Mališa Vučinić

Filip Maksimovic

David Burnett
email: dburnett@pdx.edu

Paul Muhlethaler

Thomas Watteyne

Kristofer Pister

Implications of Physical Fault Injections on Single Chip Motes

Keywords: Single chip mote, fault injection attacks, crystalfree, hardware security

Single-chip motes are wireless sensor nodes that integrate computation, communication, power and sensing on a single chip. We consider the security threats these novel devices are subject to when employed in safety-critical applications. Fault injection attacks are a prominent form of physical attacks that pose a threat to the normal and secure functioning of targeted devices, potentially compromising their intended behavior. These attacks have been studied mainly on commercial off-the-shelf devices which rely on external components such as crystal oscillators and passives. Such external components are absent from single-chip motes, resulting in a uniquely different attack surface compared to commercial systems. In this paper, we first survey the features of the common fault injection methods, and then study and compare their implications on single-chip motes.

I. INTRODUCTION

Advances in wireless communication have been a major factor in allowing the development of large networks of sensors. These networks are used for environmental monitoring, security and surveillance, healthcare and smart buildings [START_REF] Ramson | Applications of wireless sensor networks-a survey[END_REF]. The size and cost of the wireless sensor nodes, or motes, are critical factors due to their intended use in diverse settings. A lower cost makes it feasible to deploy large networks enabling extensive data collection, and a smaller size would allow the motes to be discreetly placed in areas where traditional sensors would be impractical or impossible to deploy. For example, they can be injected in the body through a syringe for therapeutic reasons [START_REF] Shi | 26.7 a 10mm3 syringe-implantable near-field radio system on glass substrate[END_REF].

The "Smart Dust" project [START_REF] Warneke | Smart dust: Communicating with a cubic-millimeter computer[END_REF] proposed in 1997 aimed at realizing a cheap and low-power mote on a micro scale. Ever since, we could observe a proliferation of commercial-offthe-shelf (COTS) motes, used in applications from passive monitoring to real-time control. One thing in common for all COTS motes is their need for a printed circuit board (PCB) to assemble them with other components like the crystal oscillator and the radio. Research projects involving low-power motes often prioritize the integration of commercial hardware onto compact PCBs rather than exploring novel embedded architectures for low-power applications [START_REF] Send | Granular radio energy-sensing node (green): A 0.56 cm 3 wireless stick-on node for non-intrusive energy monitoring[END_REF]. The advancement of the fabrication technology in the last few decades enabled decreasing the size of integrated circuits (ICs) and even eliminating the need for the assembly of individual components on a PCB. This allows the direct fabrication of complex structures in a continuous manner by integrating multiple manufacturing steps into a single continuous process. The technology unlocks the potential for miniaturization, enabling the development of compact, yet high-performance motes.

One attempt in full integration avoiding the use of a PCB is the Michigan Micro Mote, a 1 mm 3 general-purpose sensor node platform designed with five stacked IC dies, fabricated in three different technologies [START_REF] Lee | A modular 1 mm 3 die-stacked sensing platform with low power i 2 c inter-die communication and multimodal energy harvesting[END_REF], with wireless communication, battery, power management, solar harvesting, processor and memory. One downside to this design is the increased complexity when manufacturing, aligning, and bonding the different dies.

Another attempt in full integration is the Single Chip Mote project, which aims at developing a complete self-contained mote on a single chip, including sensing, computation, communication, and power, with no external components. The project is still a work in progress: the current version shown in Fig. 1 is a 2 × 3 × 0.3 mm 3 , 4.2 mg chip fabricated in 65nm CMOS process. It contains an integrated crystal-free 802.15.4-compatible radio transceiver, Bluetooth Low Energy (BLE) beacon transmitter, external sensor interface, contactless optical bootloader, and Cortex-M0 microprocessor with 64 kB each of program and data SRAM [START_REF] Maksimovic | A crystal-free single-chip micro mote with integrated 802.15. 4 compatible transceiver, sub-mw BLE compatible beacon transmitter, and cortex M0[END_REF]. The mote is small, lightweight, and has minimal external components. It requires only three wires: power, ground, and a bondwire antenna.

Given these two successful attempts, the "Smart Dust" vision starts to be a reality. However, transitioning to massive networks of single chip motes requires a careful study of the security threats that these motes are vulnerable to. Single chip motes have a novel embedded architecture presenting many differences compared to board-based systems. Thus, the level of threats that these chips are subject to may also differ.

To the best of our knowledge, physical security of smart dust and single-chip motes has not been explored previously. The goal of this paper is to present a preliminary study of the security implications on single chip motes compared to boardbased systems, when an attacker has physical access to the target. Fault attacks are the noticeable type of physical attacks, in which the normal behavior of the system is affected due to fault injections. In this study, we generalize our conclusions to both today's and future classes of single chip motes.

The contributions of this article are twofold: 1) We survey different fault injection techniques from the state-of-the-art. 2) We analyze, for the first time, how single chip systems may have different responses to a variety of fault injection techniques compared to a board-based system, from an attacker point of view. The remaining of this article is organized as follows. Section II describes the main points that distinguish single chip motes from board-based systems. Section III surveys the commonly used fault-injection-based attacks and evaluates the single chip mote architecture against each of these attack techniques. Section IV concludes this work.

II. SINGLE CHIP MOTES: A PRIMER

Single-chip mote design is different from board-based systems. Two important points of difference are: the absence of external components such as crystal oscillators for timing, and the need to fabricate these chips using a single fabrication process imposing some constraints on the type of memory that may be included in the design.

A. Crystal-free timing

Crystal oscillator is an electronic oscillator circuit incorporating, typically, a piezoelectric resonator: the crystal. The most common type of resonator used is made from quartz crystal and cut to minimize sensitivity to temperature at the temperature of interest. When a voltage source is applied to a small thin piece of quartz crystal, it begins to change shape due to the piezoelectric effect. This piezoelectric effect is the property of any material by which an electrical charge produces a shape change and vice versa: a mechanical force applied to the crystal produces an electrical charge. When included as part of a circuit including feedback and a mechanism to replenish energy lost to heat each cycle, an oscillator is formed. The quality factor of the crystal describes, e.g., how narrow a range of frequencies it will resonate at and translates into the purity and stability of the frequency produced by the oscillator.

The resonant frequency of the crystal depends on its size, shape, elasticity, and the speed of sound in the material. Due to their highly stable mechanical resonance and fabrication along particular crystallographic faces, crystals maintain their frequency with high stability over temperature and supply variations. The stability of an oscillator is quantified by its drift, typically measured in parts per million (ppm). Typically, crystal oscillators' stability is in the 10-30 ppm range for regular crystals, even down to 2-3 ppm or better for temperature-compensated versions [START_REF] Watteyne | Crystal-free network synchronization[END_REF] that incorporate mechanisms to measure the temperature and apply a correction factor to the output. Typical wireless standards are written such that they can be satisfied using frequency sources based on crystal oscillators. As such, crystal-based systems can easily satisfy the maximum frequency drift requirements required by the different standards for wireless communication, such as BLE (typically ±20 ppm to ±50 ppm), or IEEE 802.15.4 (±40 ppm).

Although crystal oscillators have become cheaper and smaller and offer better performance, their main drawback remains that they are inherently external ("off-chip") components: using them requires special fabrication and packaging steps, and process integration beyond the steps required to produce the core CMOS chip.

There is a growing trend towards adopting MEMS oscillators as an alternative to crystals. MEMS oscillators are complex, silicon-based structures often with a temperature sensor and compensation circuitry [START_REF] Van Beek | A review of MEMS oscillators for frequency reference and timing applications[END_REF]. A silicon resonator is used in lieu of a quartz crystal resonator, again with high quality factor and incorporated into a feedback circuit, such as the BAW resonators [START_REF] Griffith | A±10ppm-40 to 125°c BAW-based frequency reference system for crystal-less wireless sensor nodes[END_REF]. Similarly to crystal oscillators, these oscillators are "off-chip" external components.

We define a true single-chip "crystal-free" mote design as a solution that eliminates the need for external electronic components, including a crystal or other oscillators. Eliminating off-chip oscillators means any oscillators must be integrated alongside the rest of the circuits of the CMOS IE. These "on-chip" oscillators reduce overall system footprint and, with careful design to incorporate power source and antenna, can eliminate the need for a printed circuit board (PCB) altogether.

On-chip oscillators are composed of integrated components available in standard CMOS processes like resistors, capacitors, inductors, transistors and logic gates. As such, these components do not require any special fabrication and packaging steps during the fabrication of the circuits they are embedded alongside.

On-chip oscillator center frequency and stability are much more susceptible to thermal and flicker noise, process, voltage and temperature variations compared to crystal oscillators. Process variations are caused by changes in manufacturing conditions such as temperature, pressure, deposition and etch rates, and dopant concentration gradients. For this reason, real-world examples of single-chip crystal-free radios [START_REF] Khan | Frequency reference for crystal free radio[END_REF] show that the on-chip oscillators have 10,000+ ppm frequency Table 1. Summary of FIAs on board-based systems according to [START_REF] Barenghi | Fault injection attacks on cryptographic devices: Theory, practice, and countermeasures[END_REF], [START_REF] Li | Heavy-ion microbeam fault injection into sram-based fpga implementations of cryptographic circuits[END_REF], and on single chip motes according to our work. Gray color highlights the differing criteria. error off their nominal value depending on time scale [START_REF] Burnett | CMOS oscillators to satisfy 802.15.4 and bluetooth le phy specifications without a crystal reference[END_REF]. This is to be compared with 10-30 ppm of drift for crystal oscillators. When the internal oscillators change in response to temperature and voltage, intermittent wireless communication will provide a means for the mote to recalibrate its oscillators as long as the change is slow enough. If the change is fast, the mote will lose wireless contact and need to re-join the network.

B. Non-volatile memory constraints

Non-volatile memory is a type of memory that can store data without the need for a continuous power supply. We distinguish between two main categories of non-volatile memory: 1) non-writable non-volatile memory, e.g. Read-Only Memory (ROM) and One-Time Programmable (OTP) memory; 2) writable non-volatile memory, e.g. flash memory and Electrically Erasable Programmable Read-Only Memory (EEPROM).

Non-writable non-volatile memory can be programmed once and is typically used to store the boot code and unique device identifiers or keys. This memory is often generated using a memory compiler that takes the ROM data as input and produces a transistor layout as output. The "compiled" memory consists only of transistors and metal available in the CMOS process being used, so fabrication of this memory is naturally compatible with the process used for fabricating the rest of the chip. Therefore, this type of memory can be included in system design of single chip motes.

Writable non-volatile memories allow both read and write operations and are typically used to store and update program data. However, they typically require specialized fabrication processes and steps that must be supported in a given CMOS process. Many CMOS processes do not include options for non-volatile memories. The specific fabrication requirements vary depending on the type of non-volatile memory technology. For example, the fabrication of flash memory involves additional steps to create the floating gate structures and the necessary insulation layers. Hence, current single-chip motes do not include writable non-volatile storage, so every time that power is removed from the chip, both the program and data stored in SRAM are lost.

III. FAULT INJECTION ATTACKS (FIA)

The goal of Fault Injection Attacks (FIAs) is to inject faults into the system hardware. A fault is usually accomplished by manipulating either environmental parameters or inputs, causing the software to behave abnormally. These attacks have been used to manipulate the system behavior, such as to corrupt memory contents or to coerce microprocessors into misinterpreting and skipping program instructions. The attacker exploits this altered behavior for a variety of malicious purposes: they may be able to extract secret keys and bypass critical security protections, such as authentication checks. The attack techniques include altering the power supply voltage or the clock signal, disturbing the device using radiation or electromagnetic pulses, overheating it or exposing it to intense light or ion beams. We discuss the following attacks based on the common categorization depending on 1) cost; 2) invasiveness; 3) transiency; 4) precision:

• Cost. Similarly to Barenghi et al. [START_REF] Barenghi | Fault injection attacks on cryptographic devices: Theory, practice, and countermeasures[END_REF], we consider as low cost the injection techniques that require equipment costing less than 3000 USD, and as high cost otherwise.

It is important to know that we refer to the equipment cost as the cost needed to buy the equipment. However, using the equipment may be available as a service. For example having a Focused Ion Beam Station (FIB) station is very expensive (100 000+ USD), but for a few hundred dollars per hour an attacker can have a trained technician to perform his task. • Invasiveness. If an attack involves significant alteration of the system, whether during the attack preparation or execution, we consider it as invasive. Relevant preparation techniques include depackaging the chip and removing any protective layers (decapsulation) to directly induce faults into its internal components. These processes risk irreparable damage or destruction of the target under evaluation. Non-invasive FIAs require little-to-no tampering of the system. They can be accomplished by utilizing pin-probing or bus-snooping for example, without damaging the package. Semi-invasive FIAs require depackaging the chip to get access to the chip surface. However, semi-invasive methods do not require electrical contact to the metal surface, so the passivation layer of the chip remains intact and no mechanical damage to the silicon is caused. • Transiency. We consider errors that can be rectified by resetting the system or stopping the source of the fault as transient faults. In contrast, permanent faults alter the state of targeted components, and their impacts persist even after device restarts and resets. • Precision. Spatial precision refers to the level of accuracy with which the fault generator can inject a fault into a specific location of the system. Temporal precision is defined as the accuracy of the fault injection process in inducing a fault at a specific time. We also identify the degree of technical skill and knowledge of the implementation required to perform the injection. Table . 1 summarizes the important characteristics of the fault injection techniques from the state-of-the-art described in the next section, and highlights the limitations and the improvements imposed by applying these attacks on single chip motes compared to board-based systems.

A. Clock Glitching Definition. Clock glitches tamper with the system clock signal to induce hardware synchronization issues. To inject a clock glitch, it is possible to shorten the length of a single cycle through the introduction of additional edges to the clock signal, see Fig. 2. This shorter cycle is likely to violate setup time, hold time, and/or timing closure constraints of components in the digital system to which the clock is supplied. Attacker objectives. Shortening the length of a single cycle can trigger instruction misses caused by forcing the execution of an instruction before the CPU has completed the previous one. A short cycle can also cause data misreads by attempting to read values before the memory has latched out the request. These errors are transient and thus such faults can be induced without leaving any tamper evidence. Setup. To alter the clock signal, the attacker needs to have direct control over the clock line by connecting an external clock source. This is easily achieved for a system using an external clock generator, i.e., a crystal oscillator. In some devices, clock glitching can also be achieved purely in software by controlling the energy management regulators [START_REF] Breier | How practical are fault injection attacks, really?[END_REF].

The clock alteration techniques are required to supply a regular clock within the working range of the system, while preserving the ability of altering a single clock edge. This implies that the equipment inducing the alteration must be working at a higher clock frequency than the attacked system, and this is inherently more difficult as the target system working frequency increases. Clock glitches are generally considered to be a simple fault injection method: the target devices are easy to operate with, and no familiarity with the device implementation specifics is required. They can be achieved without any special and expensive tools, i.e., using low-end field-programmable gate array (FPGA) boards, e.g., at a price of 130 USD [START_REF] Claudepierre | Traitor: a lowcost evaluation platform for multifault injection[END_REF]. Implications on single chip mote. A single chip mote, with its "crystal-free" architecture, uses internal oscillators as frequency and clock reference for the system. To introduce a clock glitch on a single chip mote, instead of accessing the clock line trace printed on the PCB, sometimes seen using naked eye, we need to access a micro scale trace interconnecting the on-chip clock circuit and the other circuits of the chip. The attacker has to deal with a different dimension: it is not feasible to introduce a clock glitch while maintaining the same level of setup simplicity described earlier. To launch this attack, the attacker needs to be able to create tiny channels or access points on the chip surface through which a probing wire can be attached or connected. This setup involves a much more advanced, expensive and spatially precise tool, known as focused ion beam (FIB) and described in Section III-F. In this attack, the temporal precision of the clock glitches is determined by the clock injection source. Moreover, additional steps to decapsulate the chip and remove any protective layer is necessary, leading to an invasive attack.

B. Voltage Glitching

Definition. Voltage glitches manipulate the supply voltage, causing a faulty behavior in the system. The attacker attempts either to feed the system with a power supply below the considered nominal value (underfeeding) for a certain period, or to create well-timed power spikes into the supply line of the circuit, see Fig. 3. Attacker objectives. By under-powering the system, the attacker can cause some delays in the correct setup of the logic gates of the circuit, hence resulting in erroneous output. This method affects the running software continuously and might cause faults throughout the computation. To be able to perform more sophisticated attacks, the attacker needs to be able to precisely time the power spike. The injection of precise power spikes can corrupt the contents of memory units or disrupt microprocessors leading to misinterpret and even skip program instructions. These glitches modify the state of latches of flip-flops, influencing the control and data path logic of the circuit [START_REF] Kumar | Precise fault-injections using voltage and temperature manipulation for differential cryptanalysis[END_REF].For example, if the voltage spike happens during memory reading, wrong data may be retrieved. Precisely timed spikes were also used to skip security-critical checks, e.g. digital signature verification, bypass system-level access control features, and to recover information about cryptographic key material under execution [START_REF] Shepherd | Physical fault injection and side-channel attacks on mobile devices: A comprehensive analysis[END_REF]. Setup. To underfeed the supply voltage of the system, the attacker needs to tap into the power supply line of the device and connect a power supply unit. Without precise timing, the faults tend to occur uniformly throughout the computation, thus the attacker should be able to discard the results that are not useful to perform an attack. This requires only basic skills and can be easily achieved in practice without leaving an evidence of tampering. Moreover, no knowledge of the implementation details of the device is needed.

However, to execute a timed power spike injection, the attacker requires a specialized circuit capable of reducing the supply voltage below a specific threshold. This custom circuit must be synchronized with the microcontroller by utilizing the same clock signal, enabling precise timing for the spike injection. The accuracy of the voltage drop, in terms of both duration and synchronization with the target device, directly determines the temporal precision of the fault injection. For such attacks it is required to have a deep knowledge of the attacked architecture. Also, the difficulties in applying this technique increase with the clock rate of the attacked circuit, since a better temporal precision will be required to correctly time the injection of the spike. These methods require few tens of USD of equipment in order to setup the attack, as the necessary equipment could be only wires and a power source [START_REF] Breier | How practical are fault injection attacks, really?[END_REF]. Therefore, when the attacker has access to the supply line of the device, voltage glitching is generally easy and cheap to implement. Implications on single chip mote. Single-chip motes include on-chip voltage regulators. To underfeed the voltage of the single chip mote, the attacker needs to tap into the silicon and to access the power supply line trace to branch his power supply unit. This requires using an FIB workstation, mentioned in the previous attack. If the attacker wants to inject a timed voltage spike on the chip, then the setup will be even more complicated. This is because the attacker now has to access both the power supply line and the clock line, in order to listen to the chip clock and obtain a precise timing for the voltage glitch. Even if the attacker could read the clock signal without accessing the clock line directly, e.g. using sidechannel analysis, the setup will not be as simple as for a boardbased system, where the attacker can read the clock signal by only using a wire probe. Thus, in both untimed and timed scenarios of the voltage glitching attack, a single chip mote requires much more advanced equipment and skills compared to a board-based system.

However, a single chip mote is more sensitive to any voltage glitch due to its "crystal-free" nature. It uses on-chip oscillators that are less stable than crystal-oscillators when the power supply voltage changes. Even for a very small voltage variation, they start to oscillate at a different frequency and compensation is required.

C. Electromagnetic Fault Injection (EMFI)

Definition. A practical way to induce faults without having to tap into the device and attach any wire as in clock/voltage glitching, is to cause strong electromagnetic (EM) disturbances near it. The eddy currents induced in the circuit by strong EM pulses cause temporary alterations of the level of a signal, which may be recorded by a latch. Attacker objectives. High-precision probes connected to EM pulse generators can be used to perturb specific regions of the system while shielding other components. Different methods are used to perturb data in CPU registers, the pipeline, Memory Management Unit (MMU), caches or external memory [START_REF] Shepherd | Physical fault injection and side-channel attacks on mobile devices: A comprehensive analysis[END_REF]. For example, injecting a fault in the bootloader code loaded into cache memory allows the attacker to skip into an unreachable code region of the bootloader containing a command line interface for debugging purposes. Also, triggering instruction corruption errors allows the modification of a program workflow. Besides using EMFIs to trigger general instruction and data corruption faults, some works used it to examine cryptographic implementations. Setup. To inject an EM pulse, the attacker needs a near-field injection probe. He can either manufacture it from very lowcost components having a moderate knowledge in electronics, or buy it with a couple of hundreds USD. Generally, a ferrite core, a copper wire, a connector, and a heat shrinking tube are enough to create a custom probe. Furthermore, pulse injectors can be bought for a price of few thousands USD. For more powerful and precise equipment, the attacker can use high voltage EM pulse generators that would generally range between 10 000 and 20 000 USD. Hence, the cost of the equipment required to perform these attacks ranges from few hundreds to tens of thousands USD [START_REF] Breier | How practical are fault injection attacks, really?[END_REF].

EMFI is considered a fault injection technique with a poor spatial resolution, especially when considering that of laser platforms, mainly because EMFI probes are quite large. We refer to the spatial resolution as the measure of the smallest area that can be targeted by an EMFI probe, without causing unwanted faults in neighboring circuitry. Besides the probe size, the spatial resolution is affected by the pulse amplitude and its polarity, the injector position and its orientation. In a recent work, the authors could show a possible enhancement to the spatial resolution of EMFI [START_REF] Toulemont | On the scaling of emfi probes[END_REF], with an order of few hundreds of micrometers square.

Moreover, EMFI does not need a device decapsulation for chips enclosed in a standard epoxy package. However, decapsulation is required when chips have a grounded metal packaging, i.e. a heat sink, which acts as an EM shield. Decapsulation can be performed with low-cost equipment (nitric acid and common glassware), thus not raising the cost of the attack considerably. Since the EM pulse may affect undesired parts of the device, it is necessary to shield the components which should not be disturbed using a properly grounded metal plate or mesh. Implications on single chip mote. In general, an increase in target device density and complexity requires the EM injector to direct electromagnetic radiation at a smaller area of the target device. For example, suppose that two bytes of SRAM memory require 96 transistors on a chip die and the goal of the EMFI is to disturb the read of these two bytes value. In this case, the spatial resolution of the injection probe should be able to fault some subset of the 96 transistors. However, the distance between transistors and the size of the transistors, determined by the fabrication process, is decreasing significantly over time. Therefore, the spatial resolution necessary for faulting is also increasing by the same factor. An illustration of this example is shown in Fig. 4. Thus, the fabrication process used to fabricate a chip plays an important role in making this kind of attack successful or not. The more advanced (smaller) the process is, the less the spatial resolution of the attack is. Companies often use larger transistors due to the cost constraints. However, some companies prioritize energy efficiency and heat generation, so they would typically use smaller processes. Due to this variety of process fabrication used in both COTS devices and single chip motes, it is hard to make general conclusions.

D. Heating Attacks

Definition. Heating attacks alter the environmental conditions of the system, by causing the temperature to rise beyond the specified maximum limit for a normal functioning. Attacker objectives. The exposure to extreme temperatures causes multi-bit errors in dynamic random-access memory (DRAM). Data corruption or loss also results in non-volatile memory due to read/write threshold mismatches. For example, these generated bit errors can cause security vulnerabilities on a personal computer [START_REF] Govindavajhala | Using memory errors to attack a virtual machine[END_REF]. Furthermore, this attack can be used to facilitate other FIAs, such as the clock glitching attack [START_REF] Korak | Clock glitch attacks in the presence of heating[END_REF]: combined with other faults, it leads to higher success rates for inducing erroneous instruction repetitions, replacements, and modifications of their destination registers in a microcontroller. Setup. The temperature of a chip can be increased using a 50W light bulb, with a thermometer to measure the temperature [START_REF] Govindavajhala | Using memory errors to attack a virtual machine[END_REF]. Hence, the level of heating can be tuned through modifying the distance from the chip. The setup of this attack thus requires minimal technical knowledge, and the equipment has a low-cost and is easily available. However, heating attacks are among the most destructive of FIAs, leading to permanent damage after intensive exposure for a long time. Implications on single chip mote. State-of-the-art demonstrates that heating attacks are successful in tampering with dynamic random-access memory (DRAM) and non-volatile memory. However, due to the current technological limitations, state-of-the-art single chip motes do not have either DRAM nor non-volatile memory: they use SRAM memory, as discussed in Section II. SRAM is much more stable to temperature variations compared to other memory. Thus, compared to board-based systems that mostly have DRAM and non-volatile memory, single chip motes are less exposed to memory faults. Furthermore, board-based systems are exposed to the risk of damage in earlier stages of heating compared to single chip motes. The reason is simple: a CMOS die has a much higher maximum temperature (approx 350 • C) than PCBs. By approaching the maximum temperature of a PCB (approx 200 • C) the components will start to desolder, and at a much higher temperature, the ICs on the board, as well as any single chip mote, will be destroyed. However, one of the main characteristics of single chip motes is their temperature sensitivity: any variation in the ambient temperature will affect the frequency of the internal oscillators if no calibration algorithm is implemented.

E. Optical Fault Injection

Definition. Optical fault injections are based on the ionization effects on transistors caused by exposure to high energy light source. When photons with sufficient energy strike the semiconductor material of a transistor, they can transfer their energy to the electrons in the material, promoting them to a higher energy state and creating electron-hole pairs. The presence of these additional charge carriers can impact the transistor conductivity, create current surges, and introduce unintended electrical effects. Attacker objectives. Directing strong ultraviolet (UV) radiation at the silicon surface can cause the blanking of nonvolatile memory such as erasable EEPROM and FLASH memory cells. These memory cells may store constants needed for the execution of cryptographic algorithms (e.g., the AES S-Boxes). Using UV radiation can also cause the reset of the internal protection fuses of the targeted microcontroller [START_REF] Schmidt | Optical fault attacks on AES: A threat in violet[END_REF]. Similarly, a camera flash coupled with a magnifying lens can be used to target registers and skip instructions on a microcontroller, and to change the values in RAM and SRAM memory [START_REF] Guillen | Low-cost setup for localized semi-invasive optical fault injection attacks: How low can we go?[END_REF]. Furthermore, a more precise technique that security evaluation labs would typically choose, is laser fault injection. An attacker can use laser beams to probe the memory revealing its content without changing it [START_REF] Chef | Descrambling of embedded sram using a laser probe[END_REF]. A laser FIA can also cause the bypass of a secure boot process and the authentication check step, or to recover the encryption key [START_REF] Shepherd | Physical fault injection and side-channel attacks on mobile devices: A comprehensive analysis[END_REF]. While laser attacks can corrupt only NVM reading or writing, X-ray attacks can be used to directly modify nonvolatile memory content. Setup. Optical fault injection is considered a semi-invasive attack technique: the chip package needs to be removed to expose the chip to the optical source. Although depackaging can be performed with low-cost equipment, the main drawback is the possibility of damaging the circuitry or the bonding wires. The injection is normally done on the backside of the chip, as the components are less protected.

Assuming the attacker is able to successfully decapsulate a chip, he can perform fault injection attacks by illuminating the die with a high energy light source such as an UV lamp or a camera flash to cause random faults. This technique requires that the illuminated area has not been covered by a metallic layer such as metal wires, which may provide a shield against radiation. To shield the circuit parts which need not be exposed, they can be covered with a readily available UVresistant dye, or with an aperture made from aluminum foil. Furthermore, in order to obtain a sufficiently focused light beam from a camera flash, a precision microscope must be used. Although the price of this setup could be relatively high, it was recently shown that it is possible to use an inexpensive ball lens to focus the camera flash offering an equipment costing 500 USD.

Thus in order to enhance the previous technique and to introduce faults with a better precision, laser FIAs can be used. Using these intense sources of ultraviolet, infrared or visible light, an attacker can target single components on the chip, such as transistors and logic gates. A standard setup of laser FI would consist of the following parts: laser source, objective lens, motorized positioning table, and a controlling device. A digital oscilloscope can be also used to precisely align the laser activation with the execution of the target routine on the device. While the cost of a fully assembled setup would normally be less than 50 000 USD, it is possible to assemble a working setup as good as laser FI under 500 USD using a solid-state laser diode instead. The main limitation of this fault injection technique is the fact that it is not possible to achieve subwavelength precision. In fact, the width of the gate is continuously shrinking with advancements in lithography technology, thus limiting the smallest number of gates hit by the radiation.

The perturbation induced by a laser beam is limited in resolution by its wavelength to tens of micrometers [START_REF] Li | Heavy-ion microbeam fault injection into sram-based fpga implementations of cryptographic circuits[END_REF]. To modify the state of a single transistor, it is possible to use a nanofocused X-ray beam (spatial resolution of a few tens of nanometers) [START_REF] Anceau | Nanofocused x-ray beam to reprogram secure circuits[END_REF]. The advantage of this method is that there is no need to remove the chip package as it is transparent to the beam. The method also offers the advantage of deeply penetrating through materials. However, the technique is extremely expensive, in the range of millions of USD. Implications on single chip mote. With the absence of nonvolatile memory in today's single chip motes, cf. Section II-B, we are not concerned with the simplest attack technique using a UV lamp or a camera flash for erasure. Even when a camera flash with a magnification lens or a laser is used, state-ofthe art attacks are proved to be successful on microprocessors fabricated using 350 nm, 250 nm, 130 nm and 90 nm CMOS process [START_REF] Guillen | Low-cost setup for localized semi-invasive optical fault injection attacks: How low can we go?[END_REF], [START_REF] Petryk | Optical fault injection attacks against radiation-hard shift registers[END_REF]. However, there is no proof -to the best of our knowledge -that these techniques can succeed with more advanced fabrication technology such as the 65 nm process used to fabricate today's single chip motes. As mentioned above, the main limitation of using these injection methods is that they cannot achieve subwavelength precision. This is because conventionally the minimum length scale on which a beam of light can operate is equal to half its wavelength, unless light is coupled to matter, causing photonic effects that can be realized on a much smaller spatial scale. In fact, UV radiations have smaller wavelength compared to visible and infrared light, ranging from 100 to 400 nm. Thus, in theory, it is possible to target a single transistor fabricated using 65nm process using a UV laser. Furthermore, it is pretty easy to target these transistors using other radiations with smaller wavelength, such as the X-ray radiations. Thus, the spatial precision of these attacks depends on the fabrication process used, regardless if it is a COTS device or a single chip mote, as previously detailed for EMFIs.

F. Ion-based Fault Injection

Definition. The most powerful and precise fault injection techniques use focused ion beams (FIB) and heavy-ion microbeams (HIM). FIB systems typically use liquid metal ion sources, e.g. gallium ions, where the low atomic mass and relatively low energy of gallium ions make them suitable for high-resolution imaging and precision milling of materials at the micro/nanoscale. In contrast, HIM systems employ ions with high atomic masses such as gold ion, where the high energy and large mass of heavy ions enable them to penetrate deeper into materials. Attacker objectives. FIB workstations are commonly used to debug and patch chip prototypes, or to reverse engineer unknown designs through adding probing wires to otherwise inaccessible parts of the circuit. More precisely, it is possible with FIB to arbitrarily modify the structure of a circuit, reconstruct missing buses, cut existing wires, mill through layers, and rebuild them. These options represent a big advantage of using FIB compared to nanofocused Xray beams. Moreover, this capability to manipulate silicon substrates, opens up the possibility of conducting hardwarelevel reworking (microsurgery) on security-critical components, as well as the ability to extract hardware-fused keys. It is even possible to reconstruct an entire read bus of a memory containing a cryptographic key without damaging the contents of the memory [START_REF] Torrance | The state-of-the-art in ic reverse engineering[END_REF]. However, HIM are mainly used to simulate radiation-induced failures or vulnerabilities, allowing researchers to assess the device's radiation tolerance and evaluate the effectiveness of mitigation strategies. It is especially important for electronic devices destined for space applications or high-radiation environments. In brief, while FIB focuses more on precision milling and fabrication at the micro/nanoscale, HIMs are mainly used for radiation testing and fault analysis of electronic devices. Setup. On the one hand, a FIB system typically includes an ion source, an ion column for focusing and scanning the ion beam, and a sample stage where the target material is positioned. The FIB system is equipped with precise control mechanisms to position the ion beam and adjust its intensity. Imaging systems and detectors are also incorporated to observe the sample during the process. State-of-the-art FIBs can operate at a precision of 2.5 nm [START_REF] Shepherd | Physical fault injection and side-channel attacks on mobile devices: A comprehensive analysis[END_REF], less than the gate width of the smallest etchable transistor. On the other hand, an HIM system typically involves an ion accelerator, which accelerates heavy ions to high energies, and a focusing system that focuses the ion beam to a microscopic spot size. The target material or device under test is placed in the path of the focused ion beam, and detectors are used to measure the effects of the injected ions. While heavy-ion microbeams can achieve reasonably high resolution, their spatial resolution is generally not as high as that of FIB systems. They are more commonly used for larger-scale irradiation experiments. FIB and HIM attacks impose substantial cost (100 000+ USD) and require access to specialised expertise and testing equipment. They are out of the practical bounds for the class of attackers normally considered when attacking devices such as credit cards or IoT devices. However, a consideration needs to be in place for very critical systems such as military communication equipment. Implications on single chip mote. Since ion-based fault injections techniques operate at nanoscale, and can target even the smallest etchable transistor, then we notice an equivalence between performing such attacks on a single chip mote or on a PCB and its components.

IV. CONCLUSION

In this paper, we studied multiple techniques of fault injection attacks to evaluate their effects on single chip motes compared to board-based systems. Attacks that use radiation, electromagnetic pulses, or exposure to intense light or ion beams have about the same difficulty regardless if the target is a single chip mote or a PCB system. Clock and voltage glitching are easier to perform on PCB systems due to the ease of access to the interconnections. However, single chip motes can be easily affected by -intentional or unintentional -variations in the ambient temperature due to their less stable crystal-free oscillators.

Fig. 1 .

 1 Fig. 1. Annotated die photo of the Single Chip Mote version SCµM-3C.

  , FIB: Focused ion beam, HIM: Heavy-ion micro-beam. * Internal oscillators of single chip motes are less stable than crystal oscillators when the supply voltage or the temperature change.

Fig. 2 .

 2 Fig. 2. Using an FIA to introduce an additional positive clock edge.

Fig. 3 .

 3 Fig. 3. Voltage FIA.

Fig. 4 .

 4 Fig. 4. Illustration of an EM fault injection probe setup. Blue cells depict the target block of SRAM memory. Shaded cells depict unwanted faults in the neighboring area of the target block. The architecture of a single 6-transistor SRAM cell (single bit) is shown at the left bottom.