Arnaud Prouzeau
email: prouzeau@lri.fr

Anastasia Bezerianos

Olivier Chapuis
email: chapuis@lri.fr

Visual Immersion in the Context of Wall Displays

Keywords: Immersion, wall displays, field of view, visual acuity ACM Classification H.5.2 [Information interfaces and presentation (e.g., HCI)]: User Interfaces -Graphical user interfaces

Immersion is the subjective impression of being deeply involved in a specific situation, and can be sensory or cognitive. In this position paper, we use a basic model of visual perception to study how ultra-high resolution wall displays can provide visual immersion. With their large size, depending on the position of viewers in front of them, wall displays can provide a surrounding and vivid environment. Users close to the wall can have their visual field filled by the wall and they are able to see clearly a large amount information with a fine resolution. However, when close to the wall, visual distortion due to large possible viewing angles, can affect the viewing of data. On the contrary, from far away, distortion is no longer an issue, but the viewers' visual field is not fully contained inside the wall, and the information details seen are less fine.

Introduction

Immersion is a well studied concept in psychology [START_REF]Immersive interfaces for engagement and learning[END_REF][START_REF] Slater | A framework for immersive virtual environments (FIVE): Speculations on the role of presence in virtual environments[END_REF], with many different definitions that refer to the subjective impression of being deeply involved in a specific situation. This immersion can be sensory, related to the informa-tion transmitted to our senses (e.g., when wearing a Head-Mounted Display HMD); or mental, related to a more cognitive involvement (like when you read a book) [START_REF]Narrative as Virtual Reality 2[END_REF]. HMDs and CAVEs are considered to provide an almost perfect sensory immersion, as they surround viewers with virtual information. Nevertheless, in this paper we will study another kind of display that is becoming increasingly popular in data analysis, and that can provide a certain level of immersion due to its size: wall-displays. We focus on sensory immersion, as mental immersion relies more the content than on form. In particular we will discuss visual immersion. While other aspects (e.g., audio, type of interaction) can affect sensory immersion, they are less relevant to wall displays.

With their large size and high resolution, wall-displays can visualize a large quantity of data, compared to a traditional desktop [START_REF] Yost | The perceptual scalability of visualization[END_REF]. Users can come up-close to the display to get details, or move farther away to get overviews. Due to their scale and space in-front of them, they can furthermore accommodate several collaborating users [START_REF] Jakobsen | Up close and personal: Collaborative work on a high-resolution multitouch wall display[END_REF][START_REF] Liu | Shared interaction on a wall-sized display in a data manipulation task[END_REF][START_REF] Prouzeau | Evaluating multi-user selection for exploring graph topology on wall-displays[END_REF]. But wall display characteristics can also provide a better sense of engagement than on a traditional desktop, and a feeling of being more immersed in the data [START_REF] Chandler | Immersive analytics[END_REF]. Due to their large scale, they can give users the feeling of being surrounded by data, as they cover a large part of their field of view [START_REF] Ball | The effects of peripheral vision and physical navigation on large scale visualization[END_REF], especially when viewed up-close. This feeling is reinforced by the fact that users can quickly explore data via small head movements [START_REF] Liu | Effects of display size and navigation type on a classification task[END_REF]. Moreover, wall displays can provide more intuitive and immediate relationship between the user and the data, as they allow for direct interaction with the data using touch [START_REF] Jakobsen | Negotiating for space?: Collaborative work using a wall display with mouse and touch input[END_REF], and embodied interaction through simple physical navigation when walking [START_REF] Ball | Move to improve: Promoting physical navigation to increase user performance with large displays[END_REF][START_REF] Reda | Effects of display size and resolution on user behavior and insight acquisition in visual exploration[END_REF].

A display that surrounds users and provides vivid and clear visual information, can increase visual immersion [START_REF] Slater | A framework for immersive virtual environments (FIVE): Speculations on the role of presence in virtual environments[END_REF]. Surrounding the user, implies that the visual information is displayed in a panoramic way around the user, and is not limited to a narrow field of view. Vivid and clear visual information means that users can view rich information content and with an appropriate display resolution. A wall-display can be both surrounding and vivid, because of its large size and high resolution. However, the degree of immersion depends on the position of the user, and in particular her distance from the display. At a short distance, close to the display, information will fill the user's visual field, and the quantity of viewed information will be both large and of fine resolution. Farther away from the wall, the visual information and the wall will fill only part of the user's visual field, and there will be less of it that is clearly visible, due to visual acuity as we will discuss next. In the first case, the user will be more immersed in the data than in the second, and thus the closer to the wall the user is, the larger the immersion. However, due to its large size, when viewers are close to the display, there is an important distortion for shapes that are at a large angular distance [START_REF] Bezerianos | Perception of variables on tiled wall-sized displays for information visualization applications[END_REF], which can in turn deteriorate the user's immersion. In this respect, the closer to the wall the user is, the larger the distortion will be.

In this paper, we are discussing simple models that can help us study the immersion trade-offs created between user position that affects the size of the visual field that is covered by the display, and the quantity of information and possible distortion based on this position. The visual field is what a person sees instantaneously when looking straight ahead, this "image" is reflected on the retina of both eyes and then transmitted to the brain. The resolution of the retina is not uniform [START_REF] Ware | Information Visualization: Perception for Design[END_REF]. It is far higher in the central part, which is called the fovea. From there the resolution drops quickly towards the border of the retina. The visual field is divided in 4 areas: the first one is the fovea (in red in Figure 1 & 5), then surrounding it is the perifoveal area (orange), the plateau (yellow) and finally the peripheral area [START_REF] Pöppel | Light-difference threshold and subjective brightness in the periphery of the visual field[END_REF]. Table 1 gives for each area the visual angle [START_REF] Pöppel | Light-difference threshold and subjective brightness in the periphery of the visual field[END_REF] and the visual acuity compared to the fovea [START_REF] Ware | Information Visualization: Perception for Design[END_REF].

Visual Field

In the following sections, for simplicity, we won't consider the Peripheral area as its visual acuity is low, and it lacks of color and static sensitivity. However, peripheral vision is important for noticing dynamic information on wall displays [START_REF] Perteneder | Glowworms and Fireflies: Ambient light on large interactive surfaces[END_REF].

The size of the orthogonal projection of the visual field on a screen (thus actually what we see on this screen) depends on the distance between the eyes and the screen (Figure 1).

For instance, if a viewer is at distance d from a screen, the size of the projection of its fovea on screen is given by 2d • tan( ν 2 ), where ν is 3 • for the fovea (or 60 • for the plateau). This formula was used to calculate the visual field of a user at different distances from the screen (see Figure 1). Reciprocally, the visual angular size of a circle of diameter w is 2 • arctan( w 2.d ).

Distortion

The above formulae are enough when studying desktop setups. However, in the case of large wall displays, viewing in perspective (visual angle α) has an effect on visual perception. Figure 2 provides formulae to compute the distortion caused by looking at a wall in perspective: a cir- cle in the retina (corresponding to a visual angular size ν) corresponds to an ellipse (w, h) on the wall (and reciprocally, a circle on the wall is viewed as an ellipse in the visual system). This perspective viewing causes a distortion that stretches the visual field, and it is specially strong in the gaze direction when the viewer is close to the wall. Figure 5 shows examples of visual fields for viewers at different distances from the wall, and with different head rotation angles.

α d P E c x w = d • (tan(α + ν 2 ) -tan(α -ν 2 )) h = 2 • d cos(α) • tan( ν 2 )
On the contrary, this distortion makes shape on the wall seem to shrink in size, mostly in the gaze direction. This is because distortion lowers the visual angular size of a shape. Figure 3 shows the effect of distortion on the visual angle for a shape on the wall: the x-axis represents the distance between the shape and the center of the screen, and the y-axis the difference between the real visual angle of the shape and the perceived visual angle by the user, for three different positions of the user (0.5m, 1m and 3m from the display). We can see that the effect of the distortion is inversely correlated with the distance to the wall, and it becomes almost negligible when the user is at 3 meters from the wall. This is confirmed by the Figure 4, which shows how a user would see a circle on the wall as a function of the distance to the wall and the distance between the circle and the center of the wall. In order to show also the effect of distance, we also show how the circle looks in the center of the screen with the user at 0.5m as a reference. While the effect is important in the first line, it is less visible at 3m.

Note that the human vision system is aware of the distortion caused by viewing in perspective, and it corrects it "automatically" with more or less precision (see, e.g., [START_REF] Bezerianos | Perception of variables on tiled wall-sized displays for information visualization applications[END_REF] for large objects). However, this distortion clearly causes legibility issues especially when your are close to the wall.

Immersion

One characteristic of an immersive environment is that it surrounds the users, which means that it fills entirely their visual field. Several studies actually show experimentally that a screen with a large field of view is more immersive (see [START_REF] Cummings | How immersive is enough? a meta-analysis of the effect of immersive technology on user presence[END_REF] for a meta-analysis). Given our calculations, we can use the size of the visual field and the position of the users to give us information about how they are immersed.

For a 6x2m wall display, the visual field is totally inside the wall for viewers at 0.5 and 1 meters. But it extends beyond the top and bottom of the wall at 3 m. At that distance, the user is no longer immersed. As we mentioned, the visual field changes also as a function of the head rotation: with a 6 meter wall, viewers are able to turn their head up until 50

• when positioned at 0.5m from the wall, and still be immersed. Similarly, viewers are still immersed with head rotations of up to 41 • at a distance of 1m, but only by15 • at a distance of 3m (see Figure 5).

To evaluate the degree of immersion as a function of viewer distance, we compute the critical rotation angle for which their visual field is still entirely on the wall (see Figure 6). As expected, the closer viewers are to the wall, the more they are immersed. It is interesting to notice that the rate of decline is inversely correlated to the size of the wall. And that closer to the wall (touch interaction distance), the critical alphas are very similar, viewers are probably immerse regardless of the size of the wall. The angle in each case is the "critical visual angle", i.e., the max angle where the entire field remains inside the display.

Visual Acuity & Pixel density

Beside its size, an important property of a wall display is its resolution in pixels or its pixel density (that is independent of its size). Pixel density is usually expressed as the number of pixels by inch (dpi). Recent wall displays have a pixel density similar to an average desktop computer (e.g., 100 dpi). It is this high pixel density, together with their size, that make wall displays an interesting platform for data analytic. Regarding immersion, high pixel density is important to have a clear rendering, but, again, the quality of the rendering and the required pixel density depend on the position of the user in front of the wall.

We can use the formulae of Figure 2 to compute the size of a "visual pixel", the smallest entity that can be distinguished by a human with normal vision by taking ν = 1 (one minute arc, i.e., 1 60 °, the usual value that define 20/20 normal vision [START_REF] Ware | Information Visualization: Perception for Design[END_REF]). In front of the wall (α = 0), this size is about 0.145 mm at a distance of 0.5 m, 0.44 mm at 1.5 m and about 0.87 mm at 3 m (see the first column of Figure 7).

In particular, we can argue that the ideal pixel density of a desktop screen or a wall display at touch distance (0.5 m) should be about 170 dpi (pixels of 0.145 mm). Reciprocally, given a screen, we can compute the ideal distance to view this screen, as a function of the pixel density. We want the visual angular size of a real pixel of the screen to be 1 • (to match the eye's resolution, i.e., maximum information quantity, with "no" pixelisation): w 2 • cotan(0.5 ), where w is the size of a pixel. This formula gives, for example, 87 cm as the ideal viewing distance for a 100 dpi screen, and 1.45 m for a 60 dpi screen.

When viewing the display at an angle (α > 0 in Figure 2)

the shape of a "visual pixel" (the shape on screen that produces the minimal visual angular size 1 ) grows, in particular in the view direction. This is the inverse distortion phenomenon described in the previous section. Figure 7 shows some examples when looking at a wall at different angles.

To summarize, when the viewer is close to the wall, she can see clearly a lot of details in front of her. But when she turns her head (or body) to look at other parts of the wall, she can see the displayed details in far lower quality. On the other hand, when the viewer is far from the wall, she can see less details directly in front of her (first column of Figure 7), but more details when looking at other part of the wall (last column of Figure 7). To evaluate this trade-off, we computed how many visual pixels (i.e., entities that have a visual angle of 1 • ) can be put on an horizontal line on the wall, depending on the viewer's distance. To this end we covered the line, without intersection or gaps, by ellipses that represent visual pixels. This number of visual pixels can be considered as a measure of the quantity of information provided by the wall to the user when she moves her head.

Interestingly, as shown in Figure 8, the closer the user is to the wall, the more visual entities can be distinguished (we assume an "infinite" dpi, but the ideal minimal distance depends on the real dpi of the wall, see above). The large quantity of visual pixels that can be viewed just in front of the user (α ∼ 0) when they are close to the wall prevails over the larger quantity of visual pixels provided by looking in perspective (α ≫ 0) when far from the wall.

However, to take advantage of all the visual pixels when close to the wall, the information needs be presented to the user in a non homogeneous manner (the density of the information should decrease with the view angle α). In other words, the information needs to be inversely distorted.

Moreover, the above do not take into account several factors, such as the accuracy of the distortion correction made by the human visual system, the luminosity and reflection of the screen, and colors deterioration when viewing in perspective [START_REF] Bezerianos | Perceptual affordances of wall-sized displays for visualization applications: Color[END_REF][START_REF] Stone | Color and brightness appearance issues in tiled displays[END_REF].

Movement

Visualizations rendered on wall displays provide usually a uniform amount of detail across the visualization (e.g., maps) the above analysis can be combined with physical traveling: (1) travel close enough to the data to see desired details; and (2) use head movement to navigate the data. Head movement is obviously faster than physical traveling, but physical traveling is also needed.

For instance, Liu et al. [START_REF] Liu | Effects of display size and navigation type on a classification task[END_REF] suggest that one of the main factors that allow a wall to be faster than a desktop (in cases where the information viewed is small, e.g., 12pt letters) is the ability to reach quickly fine details on the wall by simple head movement (see Figure 8 of [START_REF] Liu | Effects of display size and navigation type on a classification task[END_REF]). However, physical traveling is needed to be close enough to the data so that head movements is enough to view the desired details.

Thus, an important factor regarding where and how a user should navigate is the of details of the data displayed on the wall (we have studied in this section the limit of the vision system by considering the "smallest visual entities").

Discussion

In this paper, we studied two conditions that characterize visual immersion: field of view and quality of the rendering (that depends on visual acuity).

To be immersed in the data, the user's visual field should not exceed the wall surface, and, obviously, the closer the user is to the wall, the more they can rely on head movements to explore the information space without breaking the immersion. For example, with a 6 m wall seen at 0.5 m, the user can rotate their head up to 50°and continue to be immersed. They can rotate their head up to 41°at 1 m and only 15°at 3 m and remain immersed. These angles get bigger with the size of the wall.

The visual acuity should also be high enough to have a fluid rendering, but also to display a large amount of information that can be clearly seen at the same time. The quantity of information can be measured by the number of visual entities a user can see clearly using eyes and head movements. Our model shows that the closer we are to the screen, the more information can be seen, and that the best minimal distance depends on the pixel density of the wall (smaller with higher pixel density).

Note that, a meta-analysis of a set of experimental studies suggest that the size has a stronger impact on immersion than image quality [START_REF] Cummings | How immersive is enough? a meta-analysis of the effect of immersive technology on user presence[END_REF].

Both conditions prescribe to be close to the wall. However this doesn't take distortion into consideration. When the user is close to the wall, a large part of what she can view is distorted by a perspective view effect. When the user is very close to the wall (e.g., at touch distance 0.5 m) this distortion can be very strong and become a serious problem in data analysis. The formulas allow for computing this distortion, and possible corrections to it. Thus it is necessary to find a good balance between immersion and distortion.

A way to deal with distortion is to build a curved wall instead of a flat one, but this solution can't be adapted to existing flat walls. Moreover, it is not clear that curved walls are beneficial in a collaborative context. Indeed, wall curvature reduces the space available in front of the wall and may cause more occlusions between the users and the wall. Nevertheless, it would be interesting to apply the method above to better understand the advantages of curved walls.

Another way to fight against distortion is to use wall-specific rendering techniques, such as lenses and DragMag's (or combination of them [START_REF] Kister | Embodied magic lenses and personal territories for wall displays[END_REF][START_REF] Prouzeau | Towards road traffic management with forecasting on wall displays[END_REF]), perspective correction [START_REF] Nacenta | E-conic: A perspective-aware interface for multi-display environments[END_REF], and multi-scale images [START_REF] Isenberg | Hybrid-image visualization for large viewing environments[END_REF]. We hope that our analysis could help to inform the parameterization of existing techniques, and help inspire new ones.

As a future work, we would like to validate empirically the models developed in this paper, by measuring experimentally what participants can see as a function of the wall resolution and their position. Finally, we would like to better understand immersion in a collaborative context and, in particular, its links with group awareness.

Figure 1 :

 1 Figure 1: Representation of the visual field (red, orange and yellow) for a 6x2m wall display (grey) for different distances (0.5, 1, 3 m). The user "in the middle" of the wall looking straight ahead.

Figure 3 :

 3 Figure 3: Difference between the visual angle at the origin and the actual visual angle for an object on the wall (of width w = 1m) in function of the distance x between this object and the center of the wall, for different user's distances d to the wall: 0.5m (green), 1m (blue) and 3m (black). The user is "in the middle" of the wall. θ (x, d, w) = arctan( x+ w 2 d )arctan( x-w 2 d ).

Figure 4 :

 4 Figure 4: Distortion of a circle which is at a distance x from the center of orthogonal projection (0,1 and 4 m), viewed with normal vision at a distance d from the screen. See Figure 2 for parameters x and d.

Figure 2 :

 2 Figure 2:Imagine an ellipse at position (C) on wall, with width (w, size in the PC direction) and height (h, size in the direction ⊥ to PC). This ellipse is seen as a circle of angular size ν, when viewed from position E, that is at distance d of the wall, with view angle α. For instance, if we wanted to compute what is the size of an object seen entirely in the fovea, we would use ν = 3°, and ν = 1 minute of arc to compute the size of the smallest entity that can be distinguished with normal vision.

0Figure 5 :

 5 Figure 5: Representation of the visual field (red, orange and yellow) for a 6x2m wall display (grey) for different distances (0.5, 1, 3 m).The angle in each case is the "critical visual angle", i.e., the max angle where the entire field remains inside the display.

Figure 6 :

 6 Figure 6: Critical head rotation angle α c , for which the visual field is entirely on the display, as a function of the distance d to it, for 3 wall sizes s: 12m (black), 6m (blue) and 3m (green). The user in the middle. α c (s, d) = arctan( s 2•d ) -Π 6 .

Figure 7 :Figure 2 Figure 8 :

 728 Figure 7: Smallest entities that can be viewed with normal vision at a distance d from the screen [0.5 m (first line), 1.5 m (second line) and 3 m (last line)], as a function of the distance x (horizontal direction) to the orthogonal projection of the eyes (0 m, 1 m and 4 m). See Figure 2 for parameters x and d.

Table 1 :

 1 Visual angles of each area of the visual field, and their visual acuity compared to that of the fovea. H stands for horizontal, and V for vertical.

	Area	Visual Angle	Visual Acuity
	Fovea	3 •	100 %
	Perifovea	20 •	30 %
	Plateau	H: 60 • and V: 40 •	10 %
	Peripheral	200 •	< 5 %


Weiwei Yang

Benoit Pallas

Jean-Baptiste Durand

Sébastien S Martinez

Mingyu Han

Evelyne Costes

la diffusion de documents scientifiques

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

The impact of long-term water stress on tree architecture and production is related to changes in transitions between vegetative and reproductive growth in the 'Granny Smith' apple cultivar

G F G F G F " ! c w m c w c m c w m t w m t S T P c T P θ ϕ λ + + + = = = 3 c : @ c λ . m c 11 . 5 c 1 5 m F3 1 & & = k F G w c ϕ 11 1 3. . w F3 1 & WS c ϕ = G . m w c θ 11 1 . 9 3 5 m .
3. . w/ " ! " ! . 1 9.9 " ."" 3 9.9 " 5 1 .

. +,-'. && -&& %/0 4. Relationships between parent growth unit (second order axis) age and frequency of axillary shoot death (death of third order axis) under water stress (WS) and well watered (WW) treatments. Lines represent the regression line for WW (solid line, y = 0.193x 0.286, R² = 0.96), and WS (dashed line, y = 0.171x -0.231, R² = 0.97). A generalized linear mixed effect model (binomial family) including the year and treatment effects and their interaction as fixed effects and tree as a random effect was fitted against the dataset. The significance of the fixed effects estimated using a Chi square test is represented in the top left corner. For each year, a generalized linear mixed effect model (binomial family) with treatment as a fixed effect and tree as a random effect was used, and the significance of the treatment effect is represented above the dots. *** indicates significant differences at the P < 0.001 level, and ns indicates no significant differences between treatments at P < 0.05 level. t above dots represents cases for which tree effect was significant (considering a confidence interval of 5%). Bars represent standard deviations between trees. 67x55mm (300 x 300 DPI)

" B " 1 11 " 3 %0 " !" B " F "&G S 0 " !" B " F " G 1 "" 3 ! . % . 9 "" 5 3 . . 1F " G% 1F "&G 3 " !" B " F "G " ! " B " 1 . " . 1F "G 9 1 1 . . / . "& . " 1 "" 5 . ." . 5 "5/ $ . 3 ! 1 . " " 1 11 "5 ."" ! . 1 " " ."" 9 . . 9 1 . . ". ! " 3 ." . 9. >.5 . 1 . F> ,G F<. . .1 5 ++?G 3 9 " = > ,/ > , ." 3 . 1 "" 3 C G " !F "G F 1 G F " 0" !" B " G " F n BIC + - = F0G 3 n 9 1 . . / $ 1
" i ε 1 . " . ! 1 . .9" i X i F 5 . G . 1 "" 3 C 0 ( >> ( y i i i y i i y X y ε ε - = = - - = ∑ ∑ F)G 3 y ." 9 1 5 . i ε 6%.- ." 1 " . ! 9 3 . .9" i X . 5 . / " 3


Vincent Beroulle

Philippe Candelier

Stephan De Castro

Giorgio Di Natale

Jean-Max Dutertre

Marie-Lise Flottes

David Hely

Guillaume Hubert

Régis Leveugle

Feng Lu

G Di

J.-M Dutertre

M.-L Flottes

D Hély

P Maistri

A Papadimitriou

B Rouzeyre

C Tavernier

P Vanhauwaert

Laser-Induced Fault Effects in Security-Dedicated Circuits

Keywords: Hardware security, Fault attacks, Lasers, Fault models, Security evaluation, Counter-measures

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Hardware attacks on secure integrated systems can be done by several means, including side-channel observation (measuring e.g., computation time, power consumption or electromagnetic emissions) and faulty behavior exploitation. We will focus here on fault-based attacks aiming at retrieving some confidential information such as a private cryptographic key stored in the circuit. One of the most efficient techniques to induce faults in a circuit is to use a laser [START_REF] Leveugle | Laser-induced Fault Effects in Security-dedicated Circuits[END_REF]. Since the pioneer work by Skorobogatov and Anderson [START_REF] Skorobogatov | 4th International Workshop on Cryptographic Hardware and Embedded Systems[END_REF], many experimental works have been done on laser-based attacks on various types of circuits, including smartcards but also FPGAs. However, a clear view of laser effects is still lacking [START_REF] Leveugle | Laser-induced Fault Effects in Security-dedicated Circuits[END_REF]. From a designer point-of-view, it is therefore difficult to understand the exact protec-978-1-4799-6016-3/14/$31.00 ©2014 IEEE tions ("counter-measures") to implement in a circuit, and also to identify the most critical parts in a given design.

The work presented here aims at providing a more comprehensive framework to designers. One part of the proposal concerns the definition of models representing the effects of laser attacks with several levels of abstraction. The second part concerns specific counter-measures that can be selected to increase the robustness. The designer work is also supported by specific design tools.

In this chapter, section 2 is dedicated to laser-silicon interaction. Section 3 gives an overview of the global modeling and design flow from a laser-based attack perspective. Section 4 summarizes results obtained by actual laser attacks, especially on components in the new 28nm FDSOI technology. Section 5 discusses the fault and error models. Section 6 is dedicated to the CAD tools and section 7 shows new counter-measures adapted to the effects of laser-based attacks.

2

Laser/Silicon interaction

Photoelectric effect

When light emitted by a laser hits a CMOS device, its energy is turned into electrical current thanks to the photoelectric effect. Provided that the energy of the photons emitted by the laser is sufficient, these photons create electron/hole pairs along their path through the silicon (the so-called photoelectric effect).

A current is the result of charges moving. As a consequence of the photoelectric effect, two mechanisms put the charges created by the laser in movement and therefore induce a transient current. A reverse biased PN junction (drain tied to Vdd, Psubstrate tied to Gnd) is taken as example in Fig. 1 to present these mechanisms.

Fig. 1. The mechanism responsible for Optical Beam Induced Current [START_REF] Dutertre | Design & Technology of Integrated Systmes in Nanoscale Era[END_REF] The biasing enlarges the space charge region at the interface between P and N regions. As the laser beam goes through the PN junction and the silicon, it creates electron/hole pairs. Then the charges that are close enough to the junction are moved (attracted or repulsed depending on the charge) by the effect of both the electric field and the diffusion effect. The charges that are far from the junction recombine themselves without any effect on the induced current at the drain of the junction. Fig. 2. Typical shape of nodal current at a p-n junction [START_REF] Baumann | Radiation induced soft errors in advanced semiconductor technologies[END_REF] Fig. 2 shows the typical shape of the induced transient current at the drain node created by the laser. The electric field and the diffusion effects can be differentiated on the shape. The prompt collection corresponding to the electric field effect induces a high current during a short time. The diffusion-induced current has low amplitude that lasts longer than the prompt collection. This is due to the speed of the diffusion phenomenon in silicon.

Equation ( 1) represents the general equation of the current shape observed in Fig. 2.

(1) [START_REF] Messenger | Collection of Charge on Junction Nodes from Ion Tracks[END_REF] With Q the charge deposited by the laser strike, τa the collection time constant which is a process-dependent collection time constant of the junction and τb is the ion-track establishment time constant which is relatively independent of the technology. Typical value of τa and τb can be found in [START_REF] Carreno | Analog-digital simulation of transient-induced logic errors and upset susceptibility of an advanced control system[END_REF].

The induced current can be high enough to temporarily invert the output of a logic cell, thus possibly generating an error in the circuit. The following subsection details how faults can be generated within a digital circuit, by means of a laser injection.

Single Event Transient (SET) and Single Event Upset (SEU)

The mechanism by which the induced current changes a logic value is presented in Fig. 3. An inverter gate is taken as an example.

Let assume the input of the inverter being equal to the logic value '0', therefore its output being '1'. By assuming to be in stationary conditions, the equivalent output capacitance Cload (i.e., the sum of all gate capacitances of cells connected to this output) is fully charged.

If a laser beam reaches the drain of the NMOS transistor in OFF mode (i.e. a reverse biased PN junction as exemplified in subsection 2.1), then a transient current is generated between the drain and the bulk node. This current makes electrons move from both Vdd and the equivalent output capacitance toward Gnd.

Fig. 3. Effect of the laser-induced photocurrent (red arrows) on an inverter gate

As a consequence, the output capacitance may be discharged provided that the photocurrent is higher than the current flowing through the PMOS transistor. The duration of this effect depends on the injection time. If the illumination duration is large enough, the output capacitance can be discharged at the point where its voltage falls under the threshold voltage of the next logic gates, thus causing a logic fault.

Logic faults can have different effects based on the target cell. If the laser illuminates a combinational gate (e.g. Fig. 4(a)), the erroneous transient value generated at the output of the gate must reach the downstream memory cell during the memorization time-window of that cell in order to affect the circuit behavior and propagate through the circuit at the next clock cycle. This kind of effect is called Single Event Transient (SET).

3

Global Flow: Overview Modeling and design flows are illustrated in Fig. 5, resp. left and right sides. Modeling has to be made once for a given technology and a given spectrum of laser sources and parameters. In fact, some models may be re-used from one technology to another, but new experimental measures are required to calibrate the probability of a given type of fault/error, for a given source and a given technology. Low-level physical models (or TCAD models) are derived from the analysis of the interaction between the laser beam and the circuit material. Such models are very long to simulate, so more abstract models based on current curves must be derived in order to perform simulations at the electrical level. Abstraction can then be raised again at the logical level for gate-level netlist simulation. Finally, behavioral error models corresponding to data perturbations can be proposed for early design analysis. This bottom-up process, validated by the experiments performed on real circuits, lead to a set of models adapted to several design steps.

Once the models are available, a designer can perform various analyses at several design steps. Early analyses can be made after the Register-Transfer level description, using either behavioral simulation or emulation, and injecting errors corresponding to the behavioral models. This first analysis may allow him to quantify the probability of a successful attack from a functional point of view and identify some weak points in the design (including or not some functional counter-measures). On this basis, countermeasures may be added to the design at several levels, from functional checks down to e.g., placement and routing constraints or sensor insertions. Further analyses can then be performed once the gate-level netlist is available, and then when the placement and routing has been done, with potentially electrical-level simulations using the previously developed fault models. All these steps must maximize the prob-ability that the final qualifications made on the first product prototypes confirm a satisfying level of resilience against attacks.

Measures on Bulk and FDSOI components

Measures from actual experiments using a laser are mandatory to develop and assert the validity of physical and electrical models. Previous related work was done in order to derive models of laser shots on CMOS Bulk ICs, especially on SRAM cells [START_REF] Sarafianos | Electrical modeling of the photoelectric effect induced by a pulsed laser applied to an SRAM cell[END_REF].

The model validity was assessed by a very good correlation with an experimental laser sensitivity map.

Our current modeling work is focused on the emerging 28nm Fully Depleted Silicon On Insulator (FDSOI) technology. FDSOI is mainly dedicated to low-power applications and provides thanks to well biasing techniques the ability to optimize dynamically the circuit's speed versus its power consumption [START_REF] Golanski | First demonstration of a full 28nm high-k/metal gate circuit transfer from bulk to utbb fdsoi technology through hybrid integration[END_REF]. FDSOI is also expected to bring reduced sensitivity to laser attacks due to the thin oxide box that isolates the channel of transistors from their wells [START_REF] Ferlet-Cavrois | Direct measurement of transient pulses induced by laser and heavy ion irradiation in deca-nanometer devices[END_REF]. This feature of FDSOI transistors is illustrated in Fig. 6, in which the cross sectional view of both NMOS and PMOS is drawn. Fig. 6. Cross sectional view of NMOS (left) and PMOS (right) regular V t transistors in 28nm FDSOI technology (note that dimensions are not drawn at scale for readability purposes).FDSOI transistors are built on a thin isolation box (less than 30 nm) that isolates their channel and diffusions (both source and drain) from the corresponding well. The channel of 28nm FDSOI transistors is made of intrinsic silicon; its thickness is less than 10nm. As a consequence, because of the isolation box, charge carriers induced by a laser shot outside the transistor cannot contribute to a transient current at the origin of a SET or SEU. Only charge carriers induced inside a transistor, which has a reduced volume, may create a transient current. The related phenomenon is significantly different from that described in Fig. 1 for bulk CMOS, for which charge carriers induced outside the transistor itself may contribute to the photocurrent. As a result, the induced photocurrent should be reduced both in magnitude (fewer charges are collected) and in time (because the diffusion component of a photocurrent, as drawn in Fig. 2, will not be collected due to the isolation box).

For the purpose of validating the assumption of reduced laser sensitivity of FDSOI technology and of building a simulation model we measured the laser-induced photocurrent on FDSOI test patterns (transistors of various types and sizes). We used the following laser settings: 1064nm wavelength, 20 µs pulse duration, 5 µm spot diameter and backside illumination. We report here the experiments carried out on two thick oxide high voltage NMOS transistors denoted #1 and #2 hereafter. Transistor #2's area is three times that of transistor #1. The transistors were biased in OFF state: V drain =1.8V, V source =V gate =V Pwell = 0V. The laser pulse power was set to 855mW. We measured the peak magnitude of the photocurrent pulse induced by a laser shot in the drain of the transistor as a function of the distance between the laser spot and the center of the transistor. The corresponding curves are given in Fig. 7. The maximum magnitude is found for a laser spot located on the transistor's center (distance equals to zero in Fig. 7): 8µA for transistor #1 and 27µA for transistor #2. Then, as the distance is increased, the current magnitude decreases. It tends almost toward zero after ten micrometers.

These results illustrate perfectly the main features of laser-induced photocurrents in FDSOI: (a) the photocurrent magnitude is significantly lower than that induced in Bulk CMOS transistors which would be close to the mA range for these laser settings [START_REF] Sarafianos | Building the electrical model of the Photoelectric Laser Stimulation of a NMOS transistor in 90 nm technology[END_REF], and (b) as a consequence of the isolation box, the photocurrent is halved for a distance of approximately 4µm (the laser spot diameter is 5µm), while it takes several tens of µm to halve the photocurrent in the case of a transistor in the Bulk technology [START_REF] Sarafianos | Building the electrical model of the Photoelectric Laser Stimulation of a NMOS transistor in 90 nm technology[END_REF].

According to these results, a lower sensitivity of FDSOI technology to laser attacks may be expected. However, an experimental validation on complex ICs is still needed.

5

Models: from Physical-Level to Behavioral-Level

Physical-level

Laser effects on electronics are very similar to effects induced by radiations in the sense that both laser and radiations generate electron-hole pairs in the semi-conductor; the charges are transported into the media and are collected at the electrodes of the device. In order to model these phenomena, a tool called "MUSCA SEP3" (MUlti-SCAles Single Event Phenomena Predicted Platform) has been developed and is detailed in [START_REF] Hubert | Single-Event Transient Modeling in a 65 nm Bulk CMOS Technology based-on Multi-Physical Approach and Electrical Simulations[END_REF]. It is based on a Monte Carlo approach, and consists in sequentially modeling all the physical and electrical mechanisms.

In the laser attack framework, but also for heavy ion effects in nano-scales technologies, a very important contribution concerns the accounting for the carrier/charge track structure. Pulsed lasers generate electron-hole pairs by photo-ionization process; the ionizing mechanisms are addressed in detail in [START_REF] Schmid | Optical Absorption in Heavily Doped Silicon[END_REF]. If linear absorption in semiconductor is considered (low doping level), the linear transfer energy (LET) can be de-fined by the equation (2):

x laser h e e E c h E z LET . / . . . . . . ) ( α ρ λ α - = (2)
α is the absorption coefficient in cm -1 , λ is the pulsed laser wavelength in nm, E e /h is the energy required to induce an electron-hole pair in eV, ρ is the Si density in mg/cm 3 , h is the Planck constant, c the light velocity and E laser the laser energy. Equation (2) allows for calculating the LET as a function of the depth penetration z. Since, differently from particles, laser beam does not have a punctual effect, it is necessary to define the radial deposition of the charges. Thus, the equation (3) describes the radial profile of the deposited charge:

, . . . ! (3)
with:

                - + = 2 2 2 2 . . ) .( 1 . ) ( o o o n z z z ω π λ ω ω (4)
ω o is "beam waist" i.e. the beam width for the focalization point (z = z o ) and n is the refraction index. Thanks to equations ( 2) and ( 3), it is possible to describe the 3dimensionnal charge deposition on the semi-conductor material. The next step consists in modeling the transport-collection physical mechanisms to deduce the transient pulse. Carrier generation and transport in the silicon active area is the most important part of the simulation flow and significantly influences the accuracy of collectioncharge assessment. The transport/collection physical model is based on the dynamic coupled ambipolar diffusion and collection velocity. The approach is based on charge sharing rules, which depend on the distance from strike location to collection volume, the local electric field, and the process parameters (substrate/well doping).

Required information is directly extracted from layout files in GDS format and mainly includes areas and positions of the active layer. The representative 3D structure for Monte-Carlo simulation only contains N and P active junctions (drains and sources) of the design. The global collection volume takes into account the depletion capacitance of Drain and Source-Substrate junction. Fig. 8 illustrates the GDS extractor applied to a NAND cell (0.35-µm technology). The GDS extractor allows deducing from the GDS file, the STI, the well locations and all active junctions.

Fig. 8. GDS extractor applied to academic NAND cell

Transient currents issued from physical model can be injected on each collection node, i.e., the drain of each transistor. Doing so, the electrical model of the transient pulses can be associated with the circuit netlist. The link between the layout and the netlist is performed in our flow thanks to the "Calibre" tool [13].

Electrical -level

Transient currents issued from physical model can be injected on each illuminated collection node (transistor drains or sources). Doing so, the electrical model of the transient pulses can be associated with the circuit netlist. The link between the layout and the netlist is performed in our flow thanks to the "Calibre" tool from Mentor Graphics. According to this physical-level model, the laser effect is modeled at electrical level as a plug-in current source for each illuminated junction. The model is depicted in Fig. 9. In order to link the physical-level models and the electrical-level models for simulation purpose, a database was developed; each file corresponds to a standard cell in a given library and to a laser configuration data (energy, spot size). In each file, the transient current pulses I(t) are enumerated for each collection zone according to the position of the laser (dpn_d, dpn_s) for each logic state of the standard cell.

Logical level

The eventual effect of a current injection at electrical level in a digital circuit is a modified logic signal during a period of time related to the exposure time, the socalled transient fault. The propagation of the fault and the final consequences on the circuit behavior can then be analyzed using logic-level simulations. A multi-level fault simulator has therefore been implemented and will be described in section 6.

Behavioral Level

Finding design flaws late in the design flow is costly and strongly impairs the global development time. Evaluating the resilience of a given architecture at early design steps is therefore suitable. In most cases, such evaluations start at Register-Transfer Level (RTL) in order to benefit from a precise view of the registers in the design; higher-level descriptions are too abstract to clearly identify the real hardware that will be implemented in the circuit.

Early identification of design flaws can be achieved by using fault injection techniques [START_REF] Leveugle | Early analysis of fault-based attack effects in secure circuits[END_REF]. At that level, the final design structure is not known so only errors in registers can be injected. The evaluation is meaningful only if errors injected at design time are actually representative of errors induced during a real attack. Also, evaluation time is limited so it is mandatory to trigger fault injection campaigns on reduced but significant sets of errors, including single-bit and multiple-bit error models.

Single-bit Errors.

A very usual assumption consists in modeling the effect of laser shots as bit-flips. However, some previous work reported that bit-flips are not necessarily an adequate model.

Previous work [START_REF] Roscian | Frontside laser fault injection on cryptosystems -Application to the AES' last round[END_REF] has shown that, at least in some experimental conditions, errors are unidirectional. Bits are in that case always modified in the same manner, setting them to either zero or one. Such effects lead to the error models called bit-reset or bit-set. It means that more or less bits will be sensitive to the perturbation, depending on the current state during the attack. The choice of the model may therefore have an impact on the resilience evaluation. Part of our work therefore aimed at identifying the impact of a given error model on the accuracy of early security evaluations w.r.t. differential fault attacks.

Fault injection experiments were defined on the basis of a simple circuit example, implementing a 16-bit sequential integer multiplier. This circuit is part of those currently manufactured in 28nm technologies within the project LIESSE, and will be used in further work to compare in details early analyses with the consequences of real laser attacks. No error detection or tolerance mechanism is implemented in this circuit. Errors can therefore either be silent, or lead to computation errors (or crashes). The external communication protocol is based on handshake so the differences in computation time are not taken into account for the classification; only the result value is checked. Crashes were very few so they will not be explicitly discussed.

Exhaustive single-bit error injections have been performed (in all flip-flops, at each clock-cycle, so a total of 11,410 injections) using the functional test bench used for validation of the circuit, then several similar test benches with random multiplication operands.

The first outcome is clearly the impact of the circuit state on the difference in the percentage of computation errors for the 3 models (bit-flip, bit-set, bit-reset). For this particular example with the validation test bench, bits are more often at zero than one so the bit-reset model leads to noticeably more "non-injected" errors, i.e. injections that do not modify the flip-flop contents. About 3500 single-bit error injections have no impact for the bit-set model, while near 8000 injections have no impact for the bitreset model.

The second outcome is related to the use of the fault injection results. Considering the total number of injected errors, bit-flips are the most critical errors with 40.1% computation errors, while the bit-reset model only leads to 5.9% computation errors and the bit-set model leads to 34.3% computation errors. However considering only the actual bit modifications obtained during the campaign, the most critical injections correspond to bits forced at one, with 49.5% computation errors in that case (while the percentage is 19.6% for bits forced at zero).

When using random multiplication operands, the percentages are different, but the qualitative comparison of the three models is the same.

Table 1 illustrates a more detailed view, analyzing each register independently. The register criticality level is obtained with respect to the percentage of computation errors recorded after an exhaustive fault injection campaign with each of the error models. The percentage of computation errors noticeably differs from one model to the other. However, the classification in terms of criticality only slightly differs for the functional test bench. In all cases the state register (storing the current state of the Finite State Machine) is the most critical. After that, two groups of registers can be identified (Acc/MQ and Counter/B) with some inversions between bit-set and bitreset. With random operands, results are similar for bit-flip and bit-reset, but slightly different for bit-set since the counter becomes the most critical register when "noninjected" errors are not considered. The choice of the right model to select for early fault injections therefore depends a lot on the designer intents. The bit-flip model creates more actual errors in the circuit but is more independent of the application characteristics. If those characteristics have to be taken into account, and if experiments have shown the feasibility of bit-set or bit-reset errors for a given technology, those models may lead to more accurate results, with in some cases significant differences in the error percentages. If the goal is to identify the most critical registers, the three models may lead to very similar results, at least for our case study, and in that case the bit-flip model may lead to more efficient fault injection campaigns.

Multiple-bit Errors.

One of the key benefits of a laser source, as a tool to perform fault-based attacks, is its high precision locality, although a single laser shot may generate either single or multiple faults inside an integrated circuit. These characteristics must be taken into account by an RTL laser fault model assuming multiple-bit errors. Usual methods based only on fault injections for a given maximum error multiplicity are quite timeconsuming and do not take into account the locality characteristics. Although at RT-Level it is not possible to precisely know the final placement of the element, it is possible to evaluate proximity on the basis of functional relationships.

There are two different categories of faults that can finally affect the circuit and potentially create an error. A fault may originate either from the combinational part or it can be directly injected inside a flip-flop (FF). Our proposed approach is attempting to unify these two different ways of introducing faults by modeling faults injected into the FFs of the design.

Our approach, as described in [START_REF] Papadimitriou | A multiple fault injection methodology based on cone partitioning towards RTL modeling of laser attacks[END_REF], makes use of a logic cone partitioning methodology, capable of introducing the notion of locality to an early RTL analysis including the ability to model multiple faults. The developed tool uses the elaborated RTL netlist of a behavioral (VHDL) description. The elaborated netlist and its analysis are obtained thanks to the Verific front-end API [17]. As shown in Fig. 10, the circuit under analysis is partitioned into intersecting functional blocks of combinational logic, called logic cones. Each cone starts from FFs of the circuit and/or primary inputs, and ends to another FF and/or a primary output.

Fig. 10. Logic cone partitioning of the elaborated netlist

Given a subset of the circuit, assumed as the area under attack, we are thus able to determine the sequential elements that may potentially contain an error.

Initially each attack is assumed to impact an entire logic cone and the application generates for each cone under attack a set of FFs that may potentially capture a fault. In a second step, depending on the results, this assumption can be modified to better focus laser attacks in suppressing some logic dependencies. Since we are able to know the functional relationship between the FFs of the design, we can also deduce information about the FFs that are likely to be attacked concurrently by a single laser shot, because of their potentially adjacent placement later in the design flow.

The method leads to the creation of a fault space with varying multiplicities for each attack depending on the functional relationship between the cone under attack and all the remaining cones of the circuit [START_REF] Vanhauwaert | On error models for RTL security evaluations[END_REF]. For example in Fig. 11, when Cone 2 is under attack, its fault set includes FFs: 1, 2 and 3; when Cone 3 is affected, the corresponding set includes FFs: 2, 3 and 4. These sets are also referred to as "coneattack sets". Then, multiple-bit errors are injected into each cone-attack set. Our results show that the approach achieves a noticeable reduction of the size of the fault space, compared to random exhaustive multi-bit fault approaches, without even considering a maximum multiplicity for each attack. This way we can save computational resources for a fault injection campaign and, at the same time, take into account faults that are more realistic when we model a localized laser attack. Errors are injected into the FFs of the design so the approach is compatible with fast emulation techniques that can be very useful for an RTL evaluation.

As an example, Fig. 12 shows the sets obtained for the 128-bit datapath of an AES crypto-processor. The largest cone-attack sets include 62 FFs so errors with a maximum multiplicity of 62 may be injected for those sets. On the opposite, for all sets with only one FF, single-bit error injections are sufficient. In the classical approach, the maximum multiplicity would be defined more arbitrarily and errors would be injected randomly in the global set of 512 FFs.

CAD Tools

The proposed security-evaluation flow is supported by several tools dealing with different abstraction levels. First, the databases of induced currents is generated using the MUSCA SEP3 tool on every standard cell, then the Calibre tool is used to transfer this information on the netlist of the circuit under evaluation as presented in section 5.1 and 5.2. Developed on the basis of the 0-delay simulator LIFTING [START_REF] Bosio | LIFTING: A Flexible Open-Source Fault Simulator[END_REF], tLIFTING (timing LIFTING) [START_REF] Lu | Laser-Induced Fault Simulation[END_REF] is an open-source fault simulator for single/multiple stuck-at faults, single/multiple upsets and single/multiple transients faults. The tool allows 0delay/delay-annotated logic-level simulations and transistor-level fault simulation for digital circuit described in Verilog. Cooperating with a set of sub-tools, this simulator is able to perform transistor-level simulations based on the laser-induced fault model (current curves) and then further logic-level simulation for the whole circuit in order to analyze propagations of transient misbehaviors. As an open-source tool, it was expanded to read the database generated by MUSCA SEP3. Fig. 13 shows how these tools interact with each other to produce simulation reports of laser-induced faults.

The simulation process is illustrated in Fig. 14: starting from the laser's parameters (size, position, power) and circuit layout information, affected PN junctions are located as sub-circuit in the design, and corresponding I(t) curves are extracted from the database. The corresponding electrical fault models are injected into the affected sub-circuit at transistor-level description. Then the whole system is simulated at logiclevel in order to compute the sub-circuit input waveforms during the whole external perturbation. This information is then provided to the electrical-level simulator in charge of the simulation of the sub-circuit in order to simulate the electrical perturbation. After electrical simulation of the affected gates, if the perturbation changes the state of circuit nodes, these new values are translated to logic-level for finishing the fault simulation at logic-level. Fig. 13. From physical-level to logic-level laser-induced faults simulation Fig. 14. The multi-level laser-induced fault simulation process At higher level, prototyping platforms are used in order to evaluate early in the design flow the functional consequences of errors. These platforms are based on commercial FPGA development boards, but specific tools have been developed in order to manage the injection process. Platform examples are cited in [START_REF] Ben Jrad | Comparison of FPGA platforms for emulation-based fault injections using run-time reconfiguration[END_REF].

Counter-Measures

Several types of hardware counter-measures are developed in order to improve the circuit resilience to laser-based attacks. The existing counter-measures can be classified as technological counter-measures (such as metal shield), redundancy-based counter-measures for error detection (e.g. [START_REF] Moore | Improving Smart Card Security Using Self-Timed Circuits[END_REF][23] [START_REF] Di Natale | A Reliable Architecture for Parallel Implementations of the Advanced Encryption Standard[END_REF]), detector-based countermeasures which focus on fault detection (e.g. [25][26]). In this chapter, we detail a counter-measure based on laser beam detection, i.e. a detector-based approach. The principle consists in designing a cell with higher sensibility to laser attack than any other cell in the library, and then to spread several instances of that cell over the device in order to trigger an alarm wherever the laser beam hits the circuit.

Structure of the Detector

We choose an inverter as detector because of its small size compared to other cells. When both its NMOS and PMOS transistors are affected by a laser spot, the amplitude of the transient current pulse Iph_out on the inverter output is the difference between the photocurrents generated in both transistors: Iph_out = Iph_dp -Iph_dn (Fig. 15(left)). When the inverter input is set to 1, transistor PMOS is OFF, transistor NMOS is ON, a positive current pulse Iph_out can be observed at the cell's output due to the laser attack. When Iph_out is large enough, the inverter output switches temporary from 0, the fault-free state, to 1, and this transition can be used to propagate an alarm signal (laser attack detection).

In order to improve the detection of a laser shot thanks to such inverter-based light sensor, and make the sensor more sensible than any other gate in the design, we must increase Iph_out on the sensor output. We thus propose to design a new inverter from the regular INV2 cell of the working library (AMS C35 technology) such that Iph_dp increases, Iph_dn decreases, and thus Iph_out increases. For that, we combined a large PMOS transistor with a small NMOS one. We designed a new cell from these two transistors, the S_INVP3 inverter shown in Fig. 15 (right).

The ratio of the P+/N-and N+/P-junction areas in this new cell is now 48:5 instead of 8:5 as in the original standard inverter INV2 of the target library. As detailed in [START_REF] Feng | Customized Cell Detector for Laser-Induced-Fault Detection[END_REF] for logic gates, and in [START_REF] Sarafianos | Electrical modeling of the photoelectric effect induced by a pulsed laser applied to an SRAM cell[END_REF] for SRAM cells, the photocurrents Iph_dp and Iph_dn being proportional to the area of the junctions, this new area ratio between the inverter's PMOS and NMOS transistors allows us to increase Iph_dp compared to Iph_dn and thus to increase Iph_out. The proposed invertor-based sensor is thus more sensible than the original cells (see Fig. 16 for comparison between several cells).

Similarly, we elaborated another sensor named S_INVN3 for which the ratio of the P+/N-well area and N+/P-sub is 8:30. Conversely to the S_INVP3 detector, the S_INVN3 input must be set 0 (P transistor ON, N transistor OFF) so that a laser beam provokes a negative pulse on the detector output that switches temporary from 1 (fault-free state) to 0 (transient fault used to detect the laser attack). Since detector cells have the same height as other standard cells, they can be easily integrated into the design.

Detector Sensitivity

Fig. 16 shows for several cells the minimum current density required for different laser pulse duration in order to temporarily switch the cell output. These results were obtained from models and tools developed in the framework of the LIESSE project. Clearly, the two proposed detectors are more sensitive to laser illumination than other standard cells thanks to the proposed (over)sizing of the PMOS (resp. NMOS) network compare to the NMOS (resp. PMOS) network in the proposed S_INVP3 (resp. S_INVN3) sensor. On average, the S_INVP3 is 6.5 times more sensitive than a NAND2 gate with input values set to "10", and 18.9 times more sensitive than this NAND2 gate when its input values are set to "11". For S_INVN3, these ratios are 5.1:1 and 15.1:1.

Insertion of detectors in the design

The principle is to spread detectors in the layout such that any spot location is detected by one or several detectors, and the detection signal is not masked by other detectors. For gathering all detector signals to a single detection flag, the detectors are combined into a chain-based structure as shown in Fig. 17. In this example, 4 chains have been built and connected to the flag FF thanks to a NOR gate.

Conclusions

This paper summarizes the main results obtained so far in the LIESSE project. Work is on-going to refine the tools and compare their outcomes with actual attacks on bulk and FDSOI prototypes. FDSOI is often introduced as a technological answer to radiation effects and also to laser-based fault attacks [START_REF] Golanski | First demonstration of a full 28nm high-k/metal gate circuit transfer from bulk to utbb fdsoi technology through hybrid integration[END_REF][START_REF] Alles | Radiation hardness of fdsoi and finfet technologies[END_REF] due to the thin box that isolates the CMOS transistors from their wells. To date, an experimental validation of these expectations is still pending. We brought to the reader attention the first results we have obtained on isolated NMOS transistors (at 28nm technology node) that tend toward proving this assumption. The magnitude of the laser-induced photocurrents in FDSOI transistors was found significantly lower than that induced in bulk transistors. However, we also find out that the effect area of a laser spot is reduced for FDSOI. This may be worrying because it may help an attacker to restrict fault injection to a few bits, thus making it easier to fulfill the fault models required for differential fault attacks [START_REF] Barenghi | Fault injection attacks on cryptographic devices: Theory, practice, and countermeasures[END_REF]. However, these first results and assumptions must be corroborated on ICs at the state-of-art complexity: our next research work will be to compare the laser-fault sensitivity of two CMOS 28nm circuits embedding a hardware implementation of the AES cryptoalgorithm respectively in FDSOI and bulk technologies. If full immunity seems out of scope, we nonetheless expect a reduced laser sensitivity of the FDSOI devices.

Models and tools are now available for simulation of laser-silicon interactions from low levels, for better precision on the interaction, to high levels, for dealing with large devices.

A laser-induced transient pulse model was proposed at physical level including the laser interaction in Silicon step, the carrier transport and charge collection mechanisms. This physical model calculates the transient-current response based on the underlying physics phenomena (field modulation, multiple-node charge, diffusion) and laser characteristics as the wavelength, the energy, the focalization properties and the size beam. A GDS extraction process allows for identifying the collection area in the circuit design, and transient-currents issued from physical model can be injected at circuit level. The first results on isolated N and PMOS transistors at 28nm technology node were obtained. Transient-current characteristics were compared for modelling and experiment results (as function of laser properties), first results are satisfactory. The short-term perspectives will be to use the physical model for FDSOI and bulk technologies on more complex circuits.

Results obtained on RT-level fault injections based on emulation show that the choice of the error model has noticeable effects on the early predictions made at design time. Bit-flip injections lead to more injected errors, but bit-set or bit-reset injections can have more impact when effective. The choice of the model therefore depends on the injection campaign objectives (qualitative or quantitative) and also on the knowledge of the technology and on the application execution, leading to more or less 0's and 1's in registers. Laser-based experiments on the LIESSE demonstrators will allow to better decide about the model to select.

For designers, performing fault effect analysis early in the design flow is a must. This early analysis can avoid time consuming and very expensive design re-spins. We thus propose a way to extract security-related information from RTL descriptions, particularly a list of Flip-Flop sets potentially affected at the same time by a laser shot according to the laser locality characteristics. This high-level fault injection approach is more realistic than the usual random multi-bit fault injection approach used in the literature. However our approach assumes that each laser spot impacts concurrently one entire single RTL cone and, therefore, all its intersecting cones. In our next work we will show the extent of the validity of this assumption by comparing the sets of Flip-Flops extracted from the RTL circuit description, and supposedly affected by the same laser shot, with the Flip-Flop sets arising from local attacks on the finalized layout of a circuit.

Fig. 4 .

 4 Fig. 4. (a) SET, and (b) SEU mechanisms

Fig. 5 .

 5 Fig. 5. Global flow: Modeling and Design

Fig. 7 .

 7 Fig. 7. Laser induced photocurrent magnitude [µA] in the drain diffusion of transistors #1 and #2 in OFF state as a function of the distance [µm] between the laser spot and the transistor's center

Fig. 9 .

 9 Fig. 9. Simple electrical model for a large spot laser-induced fault

Fig. 11 .

 11 Fig. 11. Determination of FFs in a "Cone-attack set"

Fig. 12 .

 12 Fig. 12. Size of AES data path cone-attack sets

Fig. 15 .

 15 Fig. 15. (left) Laser-induced effect in an inverter, and (right) Inverter-based detector cell S_INVP3

Fig. 16 .

 16 Fig. 16. Minimum current density for transmissible or detectable transient pulse (mA/µm2)

Fig. 17 .

 17 Fig. 17. The detector chain structure for injected fault detection

Table 1 .

 1 Classification of Internal Register Criticality for Single-bit Error Injections (Excluding "Non injected" Errors) -Multiplier, Functional Validation Testbench

	Criticality level	bit-flip	bit-reset	bit-set
	1	State	State	State
	2	Acc	Acc	Acc
	3	MQ	MQ	MQ
	4	Counter	B	Counter
	5	B	Counter	B

Acknowledgment.

This work has been supported by the French National Research Agency project "LIESSE" (ANR-2012-INSE-0008). The counter-measure development has also been partially supported by the contract FUI CALISSON 2 (DGCIS AAP10). TIMA is Partner of the Labex PERSYVAL Lab (ANR-11-LABX-0025).

We would like to thank Verific Design Automation Inc. for providing the Sys-temVerilog and VHDL front-end used for the implementation of our RTL methodology.