11institutetext: Delft University of Technology, Delft, The Netherlands,
11email<EMAIL_ADDRESS>22institutetext: Riscure BV, Delft, The
Netherlands, 22email<EMAIL_ADDRESS>
# On the Effect of Clock Frequency on Voltage and Electromagnetic Fault
Injection

Stefanos Koffas 11 Praveen Kumar Vadnala 22

###### Abstract

We investigate the influence of clock frequency on the success rate of a fault
injection attack. In particular, we examine the success rate of voltage and
electromagnetic fault attacks for varying clock frequencies. Using three
different tests that cover different components of a System-on-Chip, we
perform fault injection while its CPU operates at different clock frequencies.
Our results show that the attack’s success rate increases with an increase in
clock frequency for both voltage and EM fault injection attacks. As the
technology advances push the clock frequency further, these results can help
assess the impact of fault injection attacks more accurately and develop
appropriate countermeasures to address them.

###### Keywords:

RISC-V System-on-chip Voltage and Electromagnetic Fault Injection

##  1 Introduction

Fault Injection (FI) attacks have been used to attack cryptographic
implementations for over two decades. It is now well known that both symmetric
and asymmetric cryptosystems are vulnerable to Differential Fault Analysis
(DFA) attacks [9, 8, 15, 7]. However, breaking cryptographic implementations
is just one of the many possibilities for FI attacks. They have been
frequently used to break the security of smart cards and embedded devices [10,
25, 26, 27]. FI attacks have been successfully used to break secure boot,
e.g., bypassing the authentication of the code stored in flash memory,
allowing attackers to run their code on the device. Further, FI has been used
for privilege escalation or to extract firmware from the device.

_Previous Work._ Boneh, DeMillo, and Lipton demonstrated how faults induced in
hardware could be exploited to recover the secret key used in RSA [9]. In this
attack, a fault is injected while the device performs an RSA operation,
leading to incorrect output. Given several incorrect outputs and the correct
output, recovering the secret key used with a DFA attack is possible. Similar
attacks have been later proposed for other public, and symmetric-key
algorithms [15, 8, 7, 2, 1]. A survey of these successful fault attacks can be
found in [5].

Moreover, existing published results use FI to break the non-cryptographic
security mechanisms. In [26], Timmers, Spruyt, and Witteman showed that FI
could be used to load attacker-controlled data into the Program Counter (PC)
register in an ARM 32-bit platform, allowing an attacker to gain runtime
control of the device by setting the PC to an address where the attacker’s
payload is stored. In [20], the authors performed FI on the instruction cache
of ARMv7-M architectures and modified the control flow of a program. Cui and
Housley used FI to corrupt the data stored in DRAM, thereby breaking the
secure boot of an embedded device [11]. A laser FI attack has been
successfully used to break the secure boot of a smartphone in [27]. In [25],
FI has been successfully used to escalate the privileges in Linux from user
mode to kernel mode. Recently, FI has also been used to extract the firmware
from several commercial devices [10].

_Contributions._ Unlike smart cards, many embedded systems in use today are
implemented using multi-core System-on-Chips (SoCs) that are complex and host
CPUs that run at hundreds of MHz to few GHz. Most of these SoCs can operate at
different frequencies, and they often provide an option to configure their
frequency externally or internally. Moreover, some SoCs start booting directly
from an external clock that is relatively slow and switch to PLL (Phase Locked
Loop) sometime during the boot flow. This switch leads to a natural question:
does the FI’s attack success rate depend on the operating frequency?

The success rate of an FI test is defined as the number of successful faults
divided by the number of total attempts. So, naturally, as the success rate
increases, the effort required to perform a successful attack decreases.
Although dependency between the EM pulse voltage and the clock frequency along
with success rate was briefly discussed in [18] within the context of FPGA, to
the best of our knowledge, no extensive study examined the relationship
between the clock frequency and the success rate of an FI attack. In this
work, we address this gap for Voltage FI (VFI) and ElectroMagnetic FI (EMFI)
within the context of an SoC. We use SiFive’s HiFive1 development board for
our experiments, which houses the FE310-G000 chip, the first commercially
available RISC-V SoC.

_Organization._ The rest of the paper is organized as follows. We provide a
brief introduction to different FI attacks and fault models in section 2.
Next, we describe the three different test applications used in our testing in
section 3. The hardware and the software tools used for the experiments are
listed in section 4. The results from our experiments for both VFI and EMFI on
HiFive1 are presented in section 5. We provide possible reasons for the
observed behaviour in section 6. Finally, we conclude the paper in section 7.

##  2 Preliminaries

Fault injection attacks are a class of physical attacks that try to actively
modify the intended behavior of the device in order to bypass its security.
Faults can be injected into the targeted device through different means, e.g.,
varying the supply voltage or the clock speed, or using electromagnetic
emissions or laser beams [4]. In this section, we describe the common
techniques used to inject faults. We also recall various fault models from the
literature.

_Clock Fault Injection._ A fault is injected by tampering with the target’s
clock signal [3]. For example, the target is supplied with a clock signal
higher than its operating frequency for a short period reducing the length of
a single clock cycle. Thus, it may cause setup time constraint violations [28]
changing the program’s control flow, which could result in breaking a security
mechanism.

_Voltage Fault Injection_ A fault is injected by changing the target’s supply
voltage [28]. This change is applied when the targeted operation is executed,
making it possible to induce the desired effect in the device. As shown in
[28], voltage fault injection causes setup time violations like the clock
fault injection.

_Electromagnetic Fault Injection_ A fault is injected by applying a transient
or a harmonic EM pulse [12, 6, 17]. A fault injection probe consisting of a
coil generates such pulses after a high voltage pulse is applied to the coil,
inducing eddy currents into the chip. These eddy currents cause faulty
behavior that could be used to break a security mechanism.

_Optical Fault Injection._ A fault is injected into the target device with the
help of a light pulse [24]. The applied light pulse induces a photo-electric
current in the device, causing faults in the computations. The light pulse can
be generated using a low-cost camera flashlight, but often this is not
precise. For higher precision, a laser beam is used to induce the desired
light pulse.

_Fault Models._ The behavior of a device can be affected in various ways due
to fault injection attacks. These attacks can influence both the CPU’s
execution unit and the static components that store data and instructions like
the registers and the caches [25]. In general, it is difficult to determine
the exact reason behind a successful fault injection attack. Therefore, we use
high-level fault models that describe the effect of faults on the device’s
behavior on the instruction set architecture level [26]. Commonly used fault
models include:

  * •

Instruction Manipulation: The fault modifies the instruction, leading to
unexpected behavior. For example, a bit flip in the opcode field of an
instruction converts a subtraction operation into an addition.

  * •

Instruction Skipping: This is a special case of instruction manipulation that
results in a modified instruction that has no impact on the device’s behavior.
This can happen, for example, when the operands of the modified instruction
have been changed to something that is not used later by the program or when a
branch instruction has been changed to a _nop_ , i.e., no operation.

  * •

Memory Corruption: The fault affects the values loaded from a register or
memory, which can cause unexpected effects on the program execution. This can
happen when the data loaded to a register from the data cache is corrupted.
Alternatively, when the data read from the main memory is corrupted, the data
or instruction cache stores the corrupted value.

##  3 Test Applications

In this section, we propose three test applications that aim to capture the
effects of faults on different SoC components. These tests are based on the
characterization test presented in [26] and intend to cover the effect of
faults on an SoC more extensively. At a high level, a fault can modify the
instructions being executed or the data being processed through a single or
multiple bit flips. Such modifications can occur in any SoC component, like
the CPU or the memory, or during data exchange. We aim to cover different
scenarios where a fault could modify the data or instructions.

Our tests are designed to cover the effects on various SoC components. We
implemented them in assembly to fully control what is being executed on the
CPU and avoid any undesired effects caused by compiler optimizations. We show
these tests in LABEL:lst:test1, LABEL:lst:test2, and LABEL:lst:test3 in an
assembly-like pseudo-code that can be easily translated into any Instruction
Set Architecture (ISA). In all these tests, we use two general-purpose
registers named $t0$ and $t1$. Their names come from the temporary registers
defined in RISC-V but all ISAs have such registers.

###  3.1 Register-based Loop

In the register-based loop, we only use the CPU registers to implement a loop.
We use two counters: one that goes up and the other goes down. These counters
are initialized to 0 ($t0$ register) and _n_ ($t1$ register), respectively.
The test consists of a loop that increments and decrements $t0$ and $t1$,
respectively, in steps of 1, until $t1$ becomes 0. The rest of the registers
are initialized with a known fixed value (e.g., 0xdeadbeef) to monitor if the
fault modified the source or destination registers in an instruction. The test
uses only two registers to store the counters, and hence the data cache will
not be used. Additionally, as the code size is small, it should most likely
fit in the instruction cache.

A successful fault is identified by checking the value of the registers at the
end of the loop. In some cases, the registers $t0$ and $t1$ do not hold the
values _n_ and zero due to the injected fault. Alternatively, the fault could
also affect the value in the unused registers.

⬇

1 # Push a known value to all the registers

2 # N: the number of registers in the ISA

3 (t2, …, tN) $\leftarrow$ 0xdeadbeef

4 t0 $\leftarrow$ 0

5 t1 $\leftarrow$ n

6 reg_loop:

7 t0 $\leftarrow$ t0 + 1

8 t1 $\leftarrow$ t1 - 1

9 if t1 > 0 then goto reg_loop

Listing 1: Register based test

###  3.2 Memory-based Loop

The memory-based loop is similar to the register-based loop but the counters
are loaded/saved from/to the memory (using load and store instructions) in
every iteration. Again, the loop ends when $t1$ is 0 (LABEL:lst:test2). After
the first load, a copy of the data is kept in the data cache, and hence faults
would only affect the data cache and its transfers inside the loop. The loop
code should fit in the instruction cache due to its size. We also initialize
all the unused registers to a fixed value to track any corruptions in their
contents or verify whether a different register was used in a loop iteration
due to the fault. A successful fault is determined by examining the registers
and comparing their values with the expected ones.

⬇

1 # Push a known value to all the registers

2 # N: the number of registers in the ISA

3 (t2, …, tN) $\leftarrow$ 0xdeadbeef

4 t0 $\leftarrow$ 0

5 stack[sp - 4] $\leftarrow$ t0

6 t1 $\leftarrow$ n

7 stack[sp - 8] $\leftarrow$ t1

8 mem_loop:

9 t0 $\leftarrow$ stack[sp - 4]

10 t1 $\leftarrow$ stack[sp - 8]

11 t0 $\leftarrow$ t0 + 1

12 t1 $\leftarrow$ t1 - 1

13 stack[sp - 4] $\leftarrow$ t0

14 stack[sp - 8] $\leftarrow$ t1

15 if t1 > 0 then goto mem_loop

Listing 2: Memory based test

###  3.3 Unrolled Loop

In this test, we implement a fully unrolled loop. We use one up-counter ($t0$)
initialized to 0, that is incremented _n_ times through an unrolled loop.
Similar to the other two tests, we also initialize all the unused registers to
a fixed value.

In general, this test can be used in two different ways according to the
loop’s number of increment instructions. First, if a small n is used, the
program can fully fit in the instruction cache, which results in no cache
misses during the execution of the test. As a result, only transfers between
the instruction cache and the CPU are affected. This way, it is possible to
pinpoint the sensitivity of the instruction cache and the corresponding bus to
FI attacks. On the other hand, if a large _n_ is used and the program cannot
fit in the instruction cache, there will be instruction cache misses during
the execution of the test, which results in loading the instructions from the
main memory. The CPU to main memory bus’s sensitivity to FI attacks could also
be determined in such cases.

⬇

1 # Push a known value to all the registers

2 # N: the number of registers in the ISA

3 (t1, …, tN) $\leftarrow$ 0xdeadbeef

4 t0 $\leftarrow$ 0

5 t0 $\leftarrow$ t0 + 1

6 t0 $\leftarrow$ t0 + 1

7 t0 $\leftarrow$ t0 + 1

8 …

9 t0 $\leftarrow$ t0 + 1

Listing 3: Unrolled loop

A successful fault is detected when the value in $t0$ is not equal to _n_ or
when the value in any of the unused registers is corrupted.

##  4 Setup

Performing automatic execution of FI attacks requires both hardware and
software tools. In this section, we describe the tools used for our
experiments. We also briefly discuss the characteristics of the target used
for the experiments.

###  4.1 Target of Evaluation

Our target is the FE310-G000 (fabricated in TSMC CL018G 180nm [22]) which is
included in the development board HiFive1. FE310-G000’s maximum supported
frequency is 320MHz and the CPU requires 1.8V or 3.3V supply voltage to
operate [21]. We did not decap the chip due to its thin package as was also
described in [14]. The tests presented in section 3 are implemented as part of
a user-defined program that runs on bare-metal (without an operating system),
as described in subsection 4.3.

###  4.2 Hardware Tools

During our experiments, various faults (also referred to as attempts in this
paper) are injected into the device in order to identify suitable parameters
for success. For that reason, a fully automated setup has been created using
commercially available tools from Riscure [19]. We used the following hardware
tools for testing:

  * •

Glitch Generator: An FPGA based workbench that can be programmed to interact
with embedded devices. The “brain” of this device consists of two finite state
machines (up to 255 states each), which are responsible for the correct
generation of every signal that is needed for our experiments. To handle
inputs/outputs, the device consists of 32 GPIO pins that can interact with the
target. We use this device to generate the glitch used for the fault
injection. The Glitch Generator consists of six analog voltage outputs, and it
can also provide the input voltage for small embedded devices.

  * •

Glitch Amplifier: This analog device is used in conjunction with the Glitch
Generator. It is used to generate sharper and more accurate voltage glitches
that are essential in voltage fault injection attacks.

  * •

EMFI Transient Probe: The Glitch Generator controls this device. It generates
an electromagnetic pulse lasting for 50ns after the Glitch Generator triggers
it. The probe is made of a copper winding around a ferrite core, and its tip
is a flat circle with a diameter of 1.5mm.

###  4.3 Software Tools

We implemented a simple bare-metal application in C and RISC-V assembly that
runs on the FE310-G000 chip. This application accepts messages from the PC
through the UART interface and runs one of the three characterization tests
described in section 3. The message from the UART determines which test should
run every time. Right before the test starts, a GPIO pin is set to high, and
the same pin is set to low when the test ends. This pin is used in the
synchronization between the Glitch Generator and the target device. The
application can alter the chip’s operating frequency dynamically by enabling
or disabling the PLL. We used three clock configurations to investigate the
effect of different operating frequencies on both VFI’s and EMFI’s attack
success rate. The first configuration operates at 16MHz (_slow_ configuration)
and does not use the PLL clock generator. However, the _medium_ and the _fast_
configurations use the PLL. The _medium_ configuration operates at 90MHz. The
_fast_ configuration operates at 320MHz and 240MHz for the EMFI and the VFI,
respectively. We had to operate the device slightly slower than the maximum
allowed frequency for VFI due to the instabilities introduced after the board
was modified (see subsection 4.5). In Table 1, we show a summary of the
protocol used between the PC and the board.

Table 1: The list of commands used to communicate with the board

Command | Functionality
---|---
”#1” | Run the register based loop (test 1)
”#2” | Run the memory based loop (test 2)
”#3” | Run the unrolled loop (test 3)
”#4” | Enable the PLL at 320MHz (fast EMFI configuration)
”#5” | Disable the PLL and use 16MHz (slow configuration)
”#6” | Enable the PLL at 90MHz (medium configuration)
”#7” | Enable the PLL at 240MHz (fast VFI configuration)

###  4.4 EMFI Setup

(a) EMFI Setup

(b) VFI setup

Figure 1: Setups used for the experiments.

Our experimental setup used for the EMFI is shown in 1(a). The target board is
powered using an external power supply. A Python script that runs in the PC
controls the target through the UART interface and configures the state
machine inside the Glitch Generator through a user-friendly API. This state
machine consists of one state that produces the glitch when the trigger is
generated from the target device. We program the target with our test
application as we described in subsection 4.3. A jumper wire drives the
trigger signal from the target’s GPIO to the Glitch Generator. The Glitch
Generator produces another trigger that is driven to the EMFI Transient Probe.
The EMFI Transient Probe generates an EM pulse, which may or may not affect
the target. The Transient Probe is attached to a CNC (Computer Numerical
Control) machine that acts as a movable XYZ stage helping in accurate
positioning above the target device. After the application finishes its
execution, the device replies back to the PC, and the results are saved to an
SQLite database. If no reply has been received after a specific amount of
time, the target is reset by the Glitch Generator using the target’s reset
pin. We used an FTDI chip for the communication between the PC and the target.

###  4.5 VFI Setup

(a) HiFive1 CPU schematic [23]

(b) Power cuts in HiFive1 for effective voltage fault injection

Figure 2: HiFive1 CPU schematic and applied modifications.

In 2(a), the schematic that describes the circuit around the FE310-G000 chip
in the HiFive1 development board is shown. We see that pins 6, 30, and 46 are
used for the CPU’s power supply. To create a stable power supply line that is
not affected by small variations in the input voltage, some filter capacitors
are connected directly to these pins. To increase the effectiveness of the
VFI, the glitch should be applied directly to the CPU without having to pass
through the filter circuit. Therefore, we modified the HiFive1 board used for
our experiments. The applied power cuts are shown in 2(b). In particular, pins
6, 30, and 46 are cut from the rest of the circuit and soldered to an external
pin so that it is possible to connect them to a 1.8V power supply directly
(VDD_Core in the 2(b)).

The experimental setup we used for VFI is shown in 1(b). For this experiment,
the development board was powered from an external power supply at 5V. The
power cuts isolated the SoC from the rest of the board, and hence we powered
it separately. In particular, we connected the Glitch Amplifier directly to
the external pin that powers it. When there is no glitch, the output of the
Glitch Amplifier is set at 1.8V, as suggested in [21]. We verified that the
chip correctly operated in this setup even though the filter capacitors have
been removed. Like the EMFI, the target generates a trigger when the
application starts. The trigger is then driven to the Glitch Generator. Next,
the Glitch Generator produces the glitch, which is fed to the Glitch
Amplifier. The glitch drops the $V_{in}$ to a random value smaller than 1.8V
(from 1.0V to 1.6V) for a short time. We chose a broad range of values for the
glitch to investigate the chip’s behavior under various circumstances. When we
need to perform an attack, we can narrow this range and use values that yield
a high probability of a successful attack. A Python script controlled this
process, and an FTDI chip was used for the communication between the PC and
the target.

###  4.6 Results Classification

The output from a fault injection attempt is categorized as follows:

  * •

Expected: The test has completed its execution and the expected results (e.g.,
$t0$ = $n$ and $t1$ = $0$) were sent back to the PC.

  * •

Crash/Mute: The impact of the glitch was strong, and the target crashed, or
there was no reply from the target before the timeout expired. In this case,
the glitch either affects the execution path and the application cannot
continue or causes the target to reset.

  * •

Successful: The counter values ($t0$ and $t1$) returned to the PC were
different from the expected ($t0$ $\neq n$ or $t1$ $\neq 0$). Therefore, the
injected fault produced an undesirable effect on the program execution without
causing a crash.

Note that the success rate of an experiment is defined as the number of
successful attempts divided by the total number of attempts.

##  5 Experimental Results

To investigate how clock frequency affects FI success rate, we performed VFI
and EMFI experiments while the CPU was clocked at different frequencies. In
this section, we present the results from these experiments.

#### Parameter Space.

The glitch applied in every fault injection attempt is fully defined through a
set of configurable parameters. These parameters form the parameter space for
the experiment, and they are different for every type of FI attack.

###  5.1 EMFI

The effectiveness of the EMFI depends on the location of the probe. Thus, we
need to identify the location that gives the maximum success rate. For that
reason, we performed a scan over the $6\times 6$mm chip’s package [21] in a
two-dimensional grid of points. On every point in the grid, we performed
multiple FI attempts for statistical analysis. In general, the grid’s density
(distance between different points) depends on the size of the chip and its
package and the transient probe tip’s area. When the probe tip is small, a
dense grid can be used. On the other hand, when the probe tip is large, a
sparse grid should be used. If the grid remains dense even with a large tip,
every EMFI experiment can affect multiple points in the grid, introducing
redundancy in the results. We used an $8\times 8$ grid of 64 points for our
scan, which resulted in a step of 0.75mm. The diameter of our probe tip is
1.5mm, and such a step is reasonable to avoid interference between different
grid points. The grid’s origin (X $=0$, Y $=0$) corresponds to the lowest left
corner of the chip’s resin package (see FE310-G000 pinout in [21]).

The parameter space for the EMFI consists of the following:

  * •

Glitch power: The EM pulse’s amplitude as a percentage of the Transient
Probe’s maximum supported power. The maximum supported power corresponds to a
470V pulse. We saw that values above 80% resulted in many resets and below 40%
seemed ineffective. For that reason, we used values between 40% and 80% of the
maximum power.

  * •

Glitch delay: The time between the trigger and the glitch. This should not be
larger than the whole duration of the test that runs on the CPU. There was no
need for exact timing in our experiments as they were loops and our aim was to
draw a sensitivity map. Thus, the delay used was a random value between the
35% and 65% of each test’s execution time. As expected, the exact ranges are
different for every test and every clock frequency.

  * •

X: The X coordinate (in micrometers) of the grid point.

  * •

Y: The Y coordinate (in micrometers) of the grid point.

We scanned the whole chip package in this experiment. At each point, we
performed a number of attempts with varying glitch delay and glitch power,
both of which were selected randomly from the above predefined ranges. We set
_n_ equal to 10000 (0x2710). The results of this experiment are summarized in
Figure 3, Figure 4, and Figure 5. In these graphs, the x and y axes show the X
and Y co-ordinates of the grid point, respectively. The green color represents
expected results, the yellow color crashes/mutes, and the red successful
results (see subsection 4.6). We add a small random value (0-400 $\mu$m) to
each experiment’s X and Y coordinates so that they are not plotted on top of
each other.

We see from Figure 3 and Figure 4 that for the slow (16MHz) and the medium
(90MHz) clock configurations, successful glitches occurred only in the
unrolled loop (LABEL:lst:test3). These glitches occurred around the pins that
communicate with the SPI flash memory (see F310-G000 pinout in [21]). The
unrolled loop (LABEL:lst:test3) consists of 10000 additions, and it requires
an instruction cache of $10000\>\textrm{instructions}*4\>\textrm{bytes per
instruction}=40000\approx 39$KiB. However, FE310-G000 has only a 16KiB
instruction cache. Thus, our faults were most likely affecting the instruction
transfers from the flash. On the other hand, the code perfectly fits in the
instruction cache when the number of loop iterations is small, i.e., 300. In
this case, no successful glitch appeared around the region where we observed
successful glitches previously. After the first iteration of the loop, the
code is copied into the instruction cache, and there is no more interaction
with the SPI flash memory. We saw no successful glitches in that case (slow
and medium clock configurations), and we concluded that transfers from the
instruction cache to the CPU were robust in these experiments.

Figure 3: EMFI results of all three tests at 16MHz (PLL bypassed). Figure 4:
EMFI results of all three tests at 90MHz (PLL enabled). Figure 5: EMFI results
of all three tests at 320MHz (PLL enabled).

In Table 2, we summarize some of the observed successful attempts. For all the
successful attempts in the unrolled loop test, the returned value is less than
the expected 10000 (0x2710). If the returned counter value is close to 0x2710,
it is safe to conclude that some add instructions were skipped due to the
fault. This happened when $t0$ is 0x2700, 0x2708, and 0x270f for 16MHz, 90MHz,
and 320MHz, respectively. In the remaining cases (i.e., 0x256e, 0x26c2,
0x2660), there is a significant difference between the returned and the
expected values, so we cannot assume that only a few instructions were
skipped. Even though the glitch lasts for 0.8, 4.5, and 16 cycles for the
slow, medium, and fast clock configurations, the returned values differ by
418, 88, and 176 from the expected value. In [14], it was verified that an
EMFI attack could affect multiple instructions at once. However, the
probability of this effect dropped significantly for more than six
instructions. Thus, in all these cases, some instructions were altered
completely. Such alterations require multiple bit-flips for each altered
instruction that is not aligned with the state-of-the-art fault models like
the sampling [18] or the charge-based [16]. Additionally, the successful
attempts in this area were not increased as the operating frequency increased,
which contradicts the charge-based fault model [16]. We concluded that this
behavior was possible due to the retrieval of instructions from the external
SPI flash. Therefore, these errors were not of particular interest for this
work because the external SPI flash is unprotected in this board, and an
attacker could directly attack it.

The other two tests have successful faults only when the chip operates at
320MHz, verifying the charge-based fault model [16]. In particular, we
conclude that the branch instruction can be skipped in the register-based
test, as one of the results was ($t0$, $t1$) = (7190, 2810) = (0x1c16, 0xafa).
In that case, everything was run as expected until the branch instruction
because $t0+t1$= 10000. Additionally, in two cases a result larger than 10000
was saved in $t0$ (0x2e20 and 0x29ef), but the loop exited normally (i.e.,
$t1$ $=0$). This indicates that the immediate values of the additions can be
altered (instruction manipulation) because the significant difference from
10000 cannot be explained by a few instruction skips even if our glitch lasts
for 16 clock cycles.

For the memory-based loop, we observed all possible faults when the chip
operated at 320MHz. In the first case (($t0$, $t1$) = (0x270f, 0x0)), one
addition was skipped. In the second case (($t0$, $t1$) = (0x62f, 0x20e1)), the
branch instruction was skipped because $t0+t1$ = 0x2710 and $t1$ $\neq 0$. The
third case (($t0$, $t1$) = (0x31fe, 0)) shows that the constant added or
subtracted has been manipulated and changed to a completely different value.
Furthermore, memory corruption can also be seen when ($t0$, $t1$) =
(0xdeadde040, 0). In this case, during the loop’s execution, the contents of a
register with the value 0xdeadbeef were saved in the stack. This value was
retrieved in the next loop iteration. Then, the execution of the loop
continued normally for 8529 (0xdeade040 - 0xdeadbeef) iterations until $t1$
was set to zero. From Figure 5, we infer that it is easier to induce
successful faults when the target operates at the highest possible frequency.
Among the three tests, the memory-based loop (LABEL:lst:test2) has produced a
higher percentage of successful faults because memory operations (i.e., loads
and stores) are highly vulnerable to faults. Additionally, we practically
verified that each program behaves differently under the same EMFI attacks
highlighting the need for a profiling phase before targeting an application.
Such a profiling phase could define the susceptibility of different assembly
instructions to EMFI.

Table 2: Output from some of the successful faults in EMFI

Frequency | Test | t0 | t1 | Comment
---|---|---|---|---
16MHz | register based loop | - | - | -
memory based loop | - | - | -
unrolled loop | 0x256e | - | instruction manipulation (add)
0x2700 | - | instruction skipping (add)
90MHz | register based loop | - | - | -
memory based loop | - | - | -
unrolled loop | 0x26c2 | - | instruction manipulation
0x2708 | - | instruction skipping (add)
320MHz | register based loop | 0x1c16 | 0xafa | instruction skipping (branch)
0x2e20 | 0x0 | instruction manipulation (add)
0x29ef | 0x0 | instruction manipulation (add)
memory based loop | 0x270f | 0x0 | instruction skipping (add)
0x62f | 0x20e1 | instruction skipping (branch)
0x31fe | 0x0 | instruction manipulation (add)
0xdeade040 | 0x0 | memory corruption
unrolled loop | 0x2660 | - | instruction manipulation
0x270f | - | instruction skipping (add)

###  5.2 VFI

For an effective Voltage fault injection, we have removed the chip’s filter
capacitors (see subsection 4.5). The CPU was powered directly from the Glitch
Generator. Its supply voltage should be 1.8V (+/- 10%) to function normally.
For the glitch, the input voltage was dropped for a small amount of time,
different for every clock configuration.

The parameter space for the VFI consists of the following:

  * •

glitch voltage: The voltage provided to the target during the glitch. This
voltage takes values from 1V to 1.6V.

  * •

glitch length: The amount of time that the glitch (voltage drop) is applied to
the target. In our experiments, this takes up to a small number of clock
cycles.

  * •

glitch delay: The amount of time between the trigger and the glitch. It should
be smaller than the total execution time of the test that runs on the CPU.
Similar to the EMFI experiments, the delay used was a random value from 35% to
65% of the test’s execution time.

In our experiments, we varied all three parameters for each attempt. The
values for these parameters were chosen randomly from the allowed ranges.
Similar to the EMFI, we chose _n_ equal to 10000 (0x2710). We show the results
from the VFI experiment in Figures 6, 7 and 8 for the slow, medium, and fast
clock, respectively. The X-axis shows the glitch voltage in volts and the
Y-axis shows the glitch length in nanoseconds. Here, the expected results,
crashes/mutes, and successful results are marked in green, yellow, and red,
respectively (subsection 4.6). The highest frequency that the application
could run normally, when no glitch is applied, is 240MHz due to the
instabilities that we mentioned in subsection 4.5.

Our experiments show that the largest number of successful glitches appear in
the fast clock configuration (240MHz), and the smallest number of successful
glitches appear when the circuit operates at 16MHz. In [28], it was shown that
VFI increases signal propagation delays creating timing constraint violations.
Such violations become easier when the circuit operates in a higher clock
frequency due to the decreased clock period.

Figure 6: VFI results of all three tests at 16MHz (PLL bypassed). Figure 7:
VFI results of all three tests at 90MHz (PLL enabled). Figure 8: VFI results
of all three tests at 240MHz (PLL enabled).

In Table 3, we show some of the observed successful attempts. Their
classification is based on the analysis we presented in subsection 4.6. When
the clock operated at 16MHz, we see that the branch instruction can be skipped
in both the register-based loop and the memory-based loop. Here, we got ($t0$,
$t1$) = (0x1a5, 0x256b) for the register based loop and ($t0$, $t1$) =
(0x1182, 0x158e) and ($t0$, $t1$) = (0x1adb, 0x1adc) for the memory-based
loop. In the second case for the memory-based loop, $t0+t1$ $\neq$ 0x2710,
meaning that apart from the branch skipping, one more operation (add/sub) was
also manipulated. Instruction manipulation was possible in both the register-
based loop (($t0$, $t1$) = (0x25b6, 0)) and the unrolled loop ($t0$ = 0x26e0).
Furthermore, the add instruction was also successfully skipped both in the
memory-based loop (($t0$, $t1$) = (0x270f, 0)) and in the unrolled loop ($t0$
= 0x270f).

Similarly, when the clock operated at 90MHz various faults have been observed.
The branch instruction was successfully skipped for both the register-based
loop (($t0$, $t1$) = (0xeb2, 0x185e)), and the memory-based loop (($t0$, $t1$)
= (0xc37, 0x19d9), ($t0$, $t1$) = (0x608, 0x2109), ($t0$, $t1$) = (0xa3d,
0xdeadbeee)). Apart from branch skipping, we also observed memory corruption
for the memory-based loop (($t0$, $t1$) = (0xa3d, 0xdeadbee)). Here, after the
wrong value was loaded in $t1$, the subtraction was performed and then the
branch was skipped. In one case, both the sub and the branch instructions have
been skipped (($t0$, $t1$) = (0x608, 0x2109)) because the sum is 0x2711 and
$t0$ $\neq 0$. The rest of the experiments (register-based: ($t0$, $t1$) =
(0x2700, 0), memory-based: ($t0$, $t1$) = (0x270e, 0), unrolled: $t0$ =
0x2f0f, $t0$ = 0x2711) indicate some kind of instruction manipulation in the
constants that were added or subtracted.

When the clock operated at 240MHz, similar results have been observed. In this
frequency, there were multiple cases of branch skipping (register-based:
($t0$, $t1$) = (0xb85, 0xdeadbeed), ($t0$, $t1$) = (0x5f0, 0x2120), memory-
based: (0xada, 0x1c36), ($t0$, $t1$) = (0xcaa, 0xdeadbeee)). There were also
multiple examples of memory corruption for both the register-based loop
(($t0$, $t1$) = (0xb85, 0xdeadbeed)) and the memory-based loop (($t0$, $t1$) =
(0xdeadce5f, 0), ($t0$, $t1$) = (0xcaa, 0xdeadbeee)). For one of these cases
(memory-based: ($t0$, $t1$) = (0xdeadce5f, 0)), the wrong value was loaded to
$t0$ and the loop continued normally for 0xdeadce5f - 0xdeadbeef = 0xf70
iterations before it stopped. In the other two cases, the predefined value,
i.e., 0xdeadbeef was loaded to $t1$, and the sub instruction decreased $t1$ by
1 (normal execution) or 2 (instruction manipulation), and the branch
instruction was skipped in the same loop iteration. In one case for the
register-based loop, we got ($t0$, $t1$) = (0x2711, 0). This happened either
because one addition was manipulated and a 2 was added instead of 1, or one
subtraction was skipped and thus, the loop was executed for 1 more iteration.
The rest of the experiments are either instruction manipulations (memory-
based: ($t0$, $t1$) = (0x1c0f, 0), unrolled: $t0$ = 0x2720, $t0$ = 0x181c) or
addition skipping (unrolled: $t0$ = 0x270f).

Table 3: Output from some of the successful faults in VFI

Frequency | Test | t0 | t1 | Comment
---|---|---|---|---
16MHz | register based loop | 0x1a5 | 0x256b | instruction skipping (branch)
0x25b6 | 0x0 | instruction manipulation (add)
memory based loop | 0x1182 | 0x158e | instruction skipping (branch)
0x270f | 0x0 | instruction skipping (add)
0x1adb | 0x1adc | instruction manipulation (add) + instruction skipping (branch)
unrolled loop | 0x270f | - | instruction skipping (add)
0x26e0 | - | instruction manipulation (add) or instruction skipping (add)
90MHz | register based loop | 0x2700 | 0x0 | instruction manipulation (add)
0xeb2 | 0x185e | instruction skipping (branch)
0x4b38 | 0x0 | instruction manipulation (add)
memory based loop | 0x270e | 0x0 | instruction skipping (add) or instruction manipulation (sub or add)
0x608 | 0x2109 | instruction skipping (sub + branch)
0xa3d | 0xdeadbeee | memory corruption + instruction skipping (branch)
0xc37 | 0x19d9 | instruction skipping (branch)
unrolled loop | 0x2f0f | - | instruction manipulation (add)
0x2711 | - | instruction manipulation (add)
240MHz | register based loop | 0x2711 | 0x0 | instruction manipulation (add) or instruction skipping (sub)
0xb85 | 0xdeadbeed | memory corruption + instruction skipping (branch)
0x5f0 | 0x2120 | instruction skipping (branch)
memory based loop | 0x1c0f | 0x0 | instruction manipulation (add or sub)
0xada | 0x1c36 | instruction skipping (branch)
0xdeadce5f | 0x0 | memory corruption
0xcaa | 0xdeadbeee | memory corruption + instruction skipping (branch)
unrolled loop | 0x2720 | - | instruction manipulation (add)
0x181c | - | instruction manipulation (add) or instruction skipping (add)
0x270f | - | instruction skipping (add)

##  6 Discussion

In this section, we present possible explanations for the observed results.
The observed results are compatible with earlier analyses of the effects of FI
on digital integrated circuits. VFI causes timing constraint violations [28],
which in turn cause computation faults. The timing constraints essentially
dictate that the time taken by a circuit to process data must be lower than
the clock period of the target for it to function correctly. So, by increasing
the data processing time using FI, it is possible to violate the above
constraint and induce faults in the computation. As the operating frequency of
the target increases, the clock period decreases. Hence, it is relatively
easier to violate the setup time constraint, thereby increasing the success
rate of VFI.

In EMFI, we did not see only timing faults, but we also observed bit sets,
resets, and flips, meaning that our experiments are aligned with the charge-
based fault model [14] instead of the sampling fault model [18]. The sampling
fault model [18] states that the susceptibility windows of the DFFs are
independent of the operating frequency, but the distance of these windows
decreases as the clock period gets smaller [13]. As a result, one could claim
that a glitch injected randomly during the execution of a program has a higher
probability of causing a successful fault when the chip operates at a high
frequency. However, the fact that we were able to successfully inject faults
(not related to the SPI flash) only when the chip operated at 320MHz suggests
that the charge-based fault model is more accurate in this case.

In theory, the same success rate can be achieved when the target operates at a
lower frequency, e.g., by inducing more powerful voltage glitches or EM
pulses. However, the power of glitches cannot arbitrarily be increased in
practice without causing the target to reset. This behavior was also observed
in our experiments: when the target was running at 240MHz (VFI), we could get
many successful faults, where glitch duration was less than 800ns (see Figure
8). However, we needed to increase the glitch duration for the slower clock
speeds, i.e., 2000ns and 12000ns for 90MHz and 16MHz respectively (see Figure
7 and Figure 6). Such longer glitches inevitably make the target
dysfunctional, leading to more resets, as seen from these results. To
conclude, when the target operating frequency is low, the success rate
decreases due to more resets caused by the increased glitch power. This might
also explain the higher success rate when the operating frequency is higher.

##  7 Conclusion

Many embedded systems in use today are implemented using multi-core SoCs that
are complex and host CPUs that run at hundreds of MHz to few GHz. The security
of these devices faces different challenges compared to other simple devices
like smart cards. In this paper, we investigated the effect of clock frequency
on the success rate of VFI and EMFI on such SoCs. To determine the effect of
faults more holistically, we developed three test applications that target
different components of the SoC. We performed both VFI and EMFI on a RISC-V-
based SoC while it was executing our tests. The experimental results showed
that the probability of success for fault injection attacks increases as the
clock frequency increases. We saw this behavior in both VFI and EMFI. Finally,
we provided theoretical justification for the observed results.

## References

  * [1] Ross Anderson and Markus Kuhn “Low cost attacks on tamper resistant devices” In _International Workshop on Security Protocols_ , 1997, pp. 125–136 Springer
  * [2] Christian Aumüller et al. “Fault attacks on RSA with CRT: Concrete results and practical countermeasures” In _International Workshop on Cryptographic Hardware and Embedded Systems_ , 2002, pp. 260–275 Springer
  * [3] Josep Balasch, Benedikt Gierlichs and Ingrid Verbauwhede “An In-depth and Black-box Characterization of the Effects of Clock Glitches on 8-bit MCUs” In _2011 Workshop on Fault Diagnosis and Tolerance in Cryptography_ , 2011, pp. 105–114 IEEE
  * [4] Hagai Bar-El et al. “The sorcerer’s apprentice guide to fault attacks” In _Proceedings of the IEEE_ 94.2 IEEE, 2006, pp. 370–382
  * [5] A. Barenghi, L. Breveglieri, I. Koren and D. Naccache “Fault Injection Attacks on Cryptographic Devices: Theory, Practice, and Countermeasures” In _Proceedings of the IEEE_ 100.11, 2012, pp. 3056–3076
  * [6] Pierre Bayon et al. “Contactless electromagnetic active attack on ring oscillator based true random number generator” In _International Workshop on Constructive Side-Channel Analysis and Secure Design_ , 2012, pp. 151–166 Springer
  * [7] Ingrid Biehl, Bernd Meyer and Volker Müller “Differential fault attacks on elliptic curve cryptosystems” In _Annual International Cryptology Conference_ , 2000, pp. 131–146 Springer
  * [8] Eli Biham and Adi Shamir “Differential fault analysis of secret key cryptosystems” In _Annual international cryptology conference_ , 1997, pp. 513–525 Springer
  * [9] Dan Boneh, Richard A DeMillo and Richard J Lipton “On the importance of checking cryptographic protocols for faults” In _International conference on the theory and applications of cryptographic techniques_ , 1997, pp. 37–51 Springer
  * [10] Claudio Bozzato, Riccardo Focardi and Francesco Palmarini “Shaping the Glitch: Optimizing Voltage Fault Injection Attacks” In _IACR Transactions on Cryptographic Hardware and Embedded Systems_ 2019, 2019, pp. 199–224
  * [11] Ang Cui and Rick Housley “BADFET: Defeating Modern Secure Boot Using Second-Order Pulsed Electromagnetic Fault Injection” In _11th $\\{$USENIX$\\}$ Workshop on Offensive Technologies ($\\{$WOOT$\\}$ 17)_, 2017
  * [12] Amine Dehbaoui, Jean-Max Dutertre, Bruno Robisson and Assia Tria “Electromagnetic transient faults injection on a hardware and a software implementations of AES” In _2012 Workshop on Fault Diagnosis and Tolerance in Cryptography_ , 2012, pp. 7–15 IEEE
  * [13] Mathieu Dumont, Mathieu Lisart and Philippe Maurine “Electromagnetic Fault Injection : How Faults Occur” In _2019 Workshop on Fault Diagnosis and Tolerance in Cryptography (FDTC)_ , 2019, pp. 9–16 DOI: 10.1109/FDTC.2019.00010
  * [14] Mahmoud A. Elmohr, Haohao Liao and Catherine H. Gebotys “EM Fault Injection on ARM and RISC-V” In _2020 21st International Symposium on Quality Electronic Design (ISQED)_ , 2020, pp. 206–212 DOI: 10.1109/ISQED48828.2020.9137051
  * [15] Christophe Giraud “DFA on AES” In _International Conference on Advanced Encryption Standard_ , 2004, pp. 27–41 Springer
  * [16] Haohao Liao and Catherine Gebotys “Methodology for EM Fault Injection: Charge-based Fault Model” In _2019 Design, Automation Test in Europe Conference Exhibition (DATE)_ , 2019, pp. 256–259 DOI: 10.23919/DATE.2019.8715150
  * [17] Nicolas Moro et al. “Electromagnetic fault injection: towards a fault model on a 32-bit microcontroller” In _2013 Workshop on Fault Diagnosis and Tolerance in Cryptography_ , 2013, pp. 77–88 IEEE
  * [18] Sébastien Ordas et al. “Evidence of a larger EM-induced fault model” In _International Conference on Smart Card Research and Advanced Applications_ , 2014, pp. 245–259 Springer
  * [19] Riscure “Inspector Fault Injection” [Online; Accessed ], https://getquote.riscure.com/en/inspector-fault-injection.html, 2020
  * [20] Lionel Riviere et al. “High precision fault injections on the instruction cache of ARMv7-M architectures” In _2015 IEEE International Symposium on Hardware Oriented Security and Trust (HOST)_ , 2015, pp. 62–67 IEEE
  * [21] SiFive “ _FE310-G000 Datasheet_ ” [Online; Accessed: ], https://sifive.cdn.prismic.io/sifive%2Ffeb6f967-ff96-418f-9af4-a7f3b7fd1dfc_fe310-g000-ds.pdf, 2017
  * [22] SiFive “ _FE310-G000 Manual_ ” [Online; Accessed: ], https://static.dev.sifive.com/FE310-G000.pdf, 2019
  * [23] SiFive “ _HiFive1 Schematics_ ” [Online; Accessed: ], https://sifive.cdn.prismic.io/sifive%2F080cdef9-4631-4c9b-b8f5-7937fbdec8a4_hifive1-a01-schematics.pdf, 2016
  * [24] Sergei P Skorobogatov and Ross J Anderson “Optical fault induction attacks” In _International workshop on cryptographic hardware and embedded systems_ , 2002, pp. 2–12 Springer
  * [25] N. Timmers and C. Mune “Escalating Privileges in Linux Using Voltage Fault Injection” In _2017 Workshop on Fault Diagnosis and Tolerance in Cryptography (FDTC)_ , 2017, pp. 1–8
  * [26] N. Timmers, A. Spruyt and M. Witteman “Controlling PC on ARM Using Fault Injection” In _2016 Workshop on Fault Diagnosis and Tolerance in Cryptography (FDTC)_ , 2016, pp. 25–35
  * [27] Aurélien Vasselle et al. “Laser-induced fault injection on smartphone bypassing the secure boot” In _IEEE Transactions on Computers_ IEEE, 2018
  * [28] Loic Zussa, Jean-Max Dutertre, Jessy Clediere and Assia Tria “Power supply glitch induced faults on FPGA: An in-depth analysis of the injection mechanism” In _2013 IEEE 19th International On-Line Testing Symposium (IOLTS)_ , 2013, pp. 110–115 IEEE


# Evanescent Optothermoelectric Trapping: Deeper Potentials at a Largescale

Chaudhary Eksha Rani  Rahul Chand  Ashutosh Shukla  [  G V Pavan Kumar
<EMAIL_ADDRESS>[

###### Abstract

Surface plasmons (SP) and their mediated effects have been widely used to
manipulate micro- and nanoscale objects of dielectric and metallic nature. In
this work, we show how SP excitation can be used to induce thermofluidic and
thermoelectric effects to manipulate colloidal dynamics on a large scale. In
an evanescent plasmonic trap, temperature gradients induce fluid flow that can
facilitate particle accumulation. However, large out-of-plane flows expel
particles from the trap, resulting in a shallow trap potential. Here, we
numerically demonstrate how adding thermoelectric fields can overpower the
optical and hydrodynamic forces to achieve a stable nanoparticle assembly at
low excitation powers. We calculate the corresponding optical, fluidic, and
thermoelectric trapping forces and potentials. These potentials can be enabled
without resonant SP excitation, which requires careful optical alignment.
Thus, we explain the mechanism of how, despite weak optical intensities and
forces, sufficient trapping force can be supplied via the evanescent
optothermoelectric trap to obtain large-scale reversible nanoparticle
assemblies, irrespective of their shape, size, or material.

###### keywords:

American Chemical Society, LaTeX

Unknown University] Department of Physics, Indian Institute of Science
Education and Research (IISER) Pune, Pune 411008, India Unknown University]
Department of Physics, Indian Institute of Science Education and Research
(IISER) Pune, Pune 411008, India IR,NMR,UV

##  1 Introduction

Trapping and tweezing of Brownian objects received impetus thanks to the
pioneering work of Ashkin and coworkers 1, 2, 3, 4, 5. The initial and
subsequent optical tweezer designs use high numerical aperture objective
lenses to spatiotemporally trap and move micro- and nanoscopic objects.6, 7,
8, 9, 10, 11 In certain applications like microfluidics, biomedicine, and
optically driven soft and active matter large-area spatiotemporal traps are
required. This has motivated research on ‘macro’ optical traps extending up to
a few millimetres. One way to do this is to utilize evanescent waves from the
total internal reflection (TIR) of a laser that can confine objects to an area
defined by the projected evanescent waves.12, 13, 14, 15 However, creating
such large-area optical traps is a challenge. They require large powers of
hundreds of milliwatts, multiple laser channels in case of counterpropagating
evanescent waves, and careful optical alignment, making them difficult to
deploy in power-sensitive environments such as cell manipulation.
Additionally, since optical forces are not long-ranged, these traps rely on
particle diffusion, making them time-intensive 16.

An alternate strategy is to utilize these evanescent waves to excite surface
plasmons (SP) 17, facilitating radiative and absorptive channels for energy
exchange that lead to opto-thermal potentials 18, 19, 20, 21, 22. Our group
has developed large-area optothermal trapping and tweezing methods that can be
harnessed for single-molecule spectroscopy and dynamic lithography 23, 24.
However, these traps depend on the size, shape, and material of the particle,
making them highly selective 23. These trapping methods are also extremely
sensitive to the plasmonic resonances of the metal, which requires tuning the
incident wavelength 25, and polarisation 26. Moreover, SP need to be excited
resonantly at the surface plasmon resonance (SPR) angle to maximize the
optical forces, which requires additional experimental equipment and optical
alignment 27, 28. An unavoidable consequence of SP excitation is the large
temperature gradients, which induce strong fluid flows that can make the trap
unstable. It is imperative to develop optical trapping mechanisms that utilise
the consequent effects of heat and fluid flow while relaxing the resonant
excitation conditions to achieve large-scale, stable traps.29, 30, 31, 32, 33,
34 Here, we demonstrate one such mechanism using the opto-thermoelectric (OTE)
effect, which enables large-scale reversible trapping using low power non-
resonant optical excitation irrespective of the particle characteristics.35,
36, 37, 38, 39, 40 While most OTE-based trapping studies have focused on
small-area traps, a systematic study on large-area OTE traps is necessary.

In this article, we present our numerical study of evanescent OTE traps that
unveil the relative contributions of optical, hydrodynamic, and OTE fields,
showing a boost in trapping forces when OTE is employed. Consider the geometry
as shown in Figure 1(a), consisting of the glass and water domains with a 50
nm thin film of gold (Au) sandwiched in between. Gold nanoparticles (AuNP) of
diameter $2r=400$ nm, 200 nm, 300 nm, or 100 nm are considered diffusing in
water. SP are evanescently excited in the Au film that exert negligible
optical force. SP also lead to a temperature hotspot in the excitation region
that induces a fluid flow directed towards the hotspot. The in-plane flows
exert strong hydrodynamic forces to assemble AuNPs, but the out-of-plane flow
tends to make the thermofluidic trap unstable. To stabilize the trap, we
introduce a thermoelectric field by considering the presence of ions in the
fluid, which migrate under a temperature gradient. Since the thermoelectric
field is generated by optically-created temperatures, the resultant force is
called optothermoelectric force. It overpowers the thermofluidic trapping
forces by multiple orders of magnitude and enables a stable assembly of AuNPs.
Finite element method-based simulations in COMSOL multiphysics are used to
compute the plasmonic optical fields, temperature distribution, optothermally
induced fluid flow, and thermoelectric fields. The corresponding forces and
potentials experienced by an AuNP are calculated to explain the relative role
played by each. The material parameters considered are directly taken from the
in-built material library of COMSOL multiphysics unless mentioned otherwise.

Figure 1: (a) Geometry simulated to compute the fields. (b) XZ profile of
Gaussian wave exhibiting TIR at an angle $\theta_{i}=67^{o}$, greater than the
glass-water critical angle $\theta_{c}=66.5^{o}$. (c) XY profile of elliptical
temperature distribution on the Au film (thermal conductivity 150 W/m.K) due
to SP excitation. (d) Laser heating induced slip and convective fluid flows in
the XY plane 100 nm above Au film in an enlarged geometry.

##  2 Model and theory

Electromagnetic field: Figure 1 (a) shows the Kretschmann configuration used
to excite surface plasmons in the gold film 23. A p-polarised Gaussian
electromagnetic wave is incident on the glass-water interface at an angle
$\theta_{i}=67^{o}$, such that it undergoes total internal reflection
(critical angle $\theta_{c}\sim 66.5^{o}$). Consequently, evanescent waves are
generated in the water (rarer) medium, which can excite SP in the metal film.
The SP intensity can be controlled by changing the incident power or
polarisation 41 since only the TM electromagnetic wave can excite SPs in this
configuration. The electromagnetic field is simulated using the
‘electromagnetic wave frequency domain’ (ewfd) module. Being computationally
expensive, ewfd limits the maximum geometrical dimension that can be
simulated. Employing scattering boundary conditions, the geometric dimensions
are carefully chosen to avoid any boundary reflections from the reflected
wave: $H_{water}=0.5$ $\mathrm{\mu}$m, $H_{glass}=2$ $\mathrm{\mu}$m, $L=7$
$\mathrm{\mu}$m, $W=3$ $\mathrm{\mu}$m. The XZ profile of the incident light
(p-polarised, $\lambda=532$ nm, power 10 mW) undergoing TIR is shown in Figure
1(b), which gives surface fields at the Au-water interface. It should be
mentioned that such surface fields are not observed when s-polarized incident
light is simulated, which confirms the SP excitation.

Thermofluidic field: SP generation in the metal film leads to energy
dissipation via the Joule effect 42. In the temperature homogenization regime,
the temperature distribution will directly correspond with the intensity
distribution. An obliquely incident Gaussian beam will result in an elliptical
intensity spot 43 which corresponds to an elliptical temperature distribution
on the Au surface, as shown in Figure 1(c). The temperature magnitude can be
controlled using the SP intensity by tuning the power or polarization of the
incident light. Ideally, s-polarised light will not lead to any temperature
rise due to its inability to excite SP. The SP-mediated heat is modeled in
COMSOL using the ‘heat transfer in solids and fluids’ (ht) module coupled with
the ewfd module.
The heated Au film leads to temperature-induced fluid flows of two types: (1)
convective fluid flow arising from temperature-dependent density of water and
(2) slip fluid flow arising from temperature-dependent interfacial
interactions 44. These fluid flows are simulated using the ‘laminar flow’
(spf) module coupled to the ht module. The Au-water interface is set to slip
boundary condition with a dimensionless slip coefficient $\sigma_{T}=0.001$ 45
to compute the slip flow and no-slip boundary condition to compute the
convective flow. All other walls are set to open boundary conditions. However,
experiments with colloidal solutions are usually performed in larger fluid
columns to minimize boundary effects on colloidal diffusion. But, since
computing such large domains is extremely memory-expensive for ewfd, we used
an alternative heat source called ‘deposited beam power’ that models the
temperature profile of a laser-heated surface without explicitly modeling the
laser. Thus, eliminating ewfd, we enlarged the fluid column while
significantly reducing the computational resources needed: $H_{water}=5$
$\mathrm{\mu}$m, $H_{glass}=2$ $\mathrm{\mu}$m, $L=10$ $\mathrm{\mu}$m, $W=10$
$\mathrm{\mu}$m. The parameters of the Gaussian laser used by ‘deposited beam
power’ are carefully chosen to match the temperature profile generated via the
ewfd-mediated heat source. The corresponding slip and convective fluid flow in
the XY plane (100 nm above Au surface) are shown in Figure 1(d), where the
contours represent the temperature rise against a room temperature of 298 K.

Thermoelectric field: If the fluid contains ions that migrate differently
under a temperature gradient, then spatial separation of ions can be achieved.
40, 46 This will produce an electrostatic field in the fluid called the
thermoelectric field $E_{T}=\frac{k_{B}T\nabla
T}{e}\frac{\sum_{i}Z_{i}c_{i}S_{T_{i}}}{\sum_{i}Z_{i}^{2}c_{i}}$, directed
along the temperature gradient. Here, $i$ indicates the ionic species, $k_{B}$
is the Boltzmann constant, $e$ is the elementary charge, $Z$ is the charge
number, and $c$ is the concentration of ions. Once $E_{T}$ is activated, it
can exert thermoelectric force $F^{OTE}=Q\cdot E_{T}$ on any particle having
total charge $Q$, driving it towards or away from the hotspot. The temperature
$T$ and its gradient $\nabla T$ are extracted from the COMSOL model to compute
the thermoelectric fields and forces.

##  3 Results and discussion

Optical force: A spherical AuNP is modeled in the water domain 20 nm above the
Au surface (which is of the order of Debye length) 47, 43, 48 at the center of
the SP excitation spot. The optical forces exerted due to SP fields are
calculated by integrating the Maxwell stress tensor over the AuNP surface 49.
The resultant optical forces are of the order $10^{-22}-10^{-20}$ N , which is
negligibly small compared to the Brownian forces experienced by these
particles in the range $10^{-16}-10^{-14}$ N 25. Such weak optical forces are
due to the non-resonant excitation of SP at $\theta_{i}$, where only a small
fraction of incident power is coupled to SP, and the majority is reflected
back into glass. To maximize the optical forces up to a femtonewton order, (1)
SP can be resonantly excited at SPR angle well beyond $\theta_{c}$ 27, 28, or
(2) laser power can be increased 27, or (3) particle resonances can be matched
with the laser wavelength 25 and polarization 23, 50. Experimentally, it may
not always be possible to tune $\theta_{i}$ to the SPR angle or optimize the
trap to match particle resonances. Moreover, largescale trapping will require
large input powers. To execute an efficient trap without changing the
excitation angle, power, or wavelength, it is imperative to utilize the
dissipated optical energy in the form of heat to manipulate colloids. Given
the small magnitude of optical forces, we consider that the SP fields have
minimal effect on particle dynamics.

Figure 2: (a) x-component of thermoelectric force $F_{x}^{OTE}$ exerted on
AuNPs of different diameters. (b) Comparison between trap potential $U_{x}$
felt by a 400 nm AuNP along X due to OTE and slip forces. (c) Comparison
between the trap stiffness (k) along X and Y due to $F_{x,y}^{OTE}$ and
$F_{x,y}^{slip}$ forces for AuNP of different diameters. (d) Variation of
maximum slip flow velocity and trap stiffness for 400 nm AuNP, due to
$F_{x}^{OTE}$ and $F_{x}^{slip}$ forces, with maximum temperature rise $\Delta
T_{max}$.

OTE and hydrodynamic slip force calculation: The most prominent heat-mediated
effects widely used in trapping are the thermophoresis31, thermofluidic 51 and
thermoelectric 35 effects. Since metallic colloids do not exhibit
thermophoresis, AuNP does not migrate under a temperature gradient 44 and will
be driven by the fluid flow in the system under the effect of hydrodynamic
forces. We have done a numerical study to compare the two remaining effects
and found that the thermoelectric force is much stronger and gives greater
control over particle dynamics than the thermofluidic forces. To study the
thermoelectric effect, consider an AuNP freely diffusing in a 5 mM solution of
a surfactant CTAC (cetyltrimethylammonium chloride) that dissociates into CTA+
and Cl- ions. Above the critical micellar concentration, CTAC self-assembles
into micelles, forming macrocations. The CTAC molecules get adsorbed on the
AuNP surface, forming a double layer and making it positively charged with a
zeta potential $\zeta$. We have approximated $\zeta=63.6$ mV, 73.3 mV, 76 mV,
and 80 mV for $2r=100$ nm, 200 nm, 300 nm, and 400 nm, respectively 52,
considering the general trend of $\zeta$ measurements in 5 mM CTAC. Without a
temperature gradient, the positively charged AuNP, CTAC micelles, and Cl- ions
are randomly dispersed in the solution. Under the SP-mediated temperature
gradient, the micelles and Cl- ions will move differently owing to their
different Soret coefficients (CTAC micelles: $10^{-2}$, Cl- ions: $7.18\times
10^{-4}$) 53, leading to a spatial separation between positive and negative
ions. This generates an electrostatic field $E_{T}$ that can exert
thermoelectric force $F^{OTE}=(4\pi r^{2}\sigma)\cdot E_{T}$ on a spherical
particle having surface charge density $\sigma$ 54. Using $T\nabla T$ from the
COMSOL simulation, we computed the force components $F_{x}^{OTE}$,
$F_{y}^{OTE}$, and $F_{z}^{OTE}$ exerted on an AuNP located 20 nm above the Au
surface. $F_{x}^{OTE}$, shown in Figure 2(a), in the pN order, is much
stronger than the minimum fN order of trapping force required to confine AuNP
at the hotspot. The magnitude and slope increase with particle size $2r$ due
to the greater zeta potential of larger particles, giving them greater surface
charge.

To compare with the thermofluidic effects, we estimated the hydrodynamic force
on AuNP due to temperature-induced fluid flows. For a spherical particle with
a small Reynolds number ($\sim 10^{-6}$), the hydrodynamic force is given by
the Stokes equation $F=\gamma\cdot v=6\pi\eta rv$, where $\eta$ is the dynamic
viscosity of the fluid, $v$ is the fluid velocity, and $\gamma$ is the
friction coefficient near a surface, which gets modified compared to its bulk
value $\gamma_{0}$ as $\gamma=\alpha\gamma_{0}$ 55, 49. Using the slip or
convective flow velocity from COMSOL, we can calculate the hydrodynamic slip
and convective forces, $F^{slip}$ and $F^{conv}$, respectively.

OTE vs hydrodynamic force: To compare the OTE and the fluid forces, we will
consider the 400 nm AuNP. Figure 2(b) shows the x-component of OTE,
$F_{x}^{OTE}$, and hydrodynamic slip forces $F_{x}^{slip}$, along with the
respective potentials $U_{x}$. We consider only $F_{x}^{slip}$ for comparison
as it is larger of the two fluid forces. While both $F_{x}^{OTE}$ and
$F_{x}^{slip}$ are strong enough to trap AuNPs, $F_{x}^{OTE}$ is ten times
stronger with a thermoelectric trap stiffness $k_{x}^{OTE}=2.56$ pN/$\mu$m
compared to the thermofluidic trap stiffness $k_{x}^{slip}=0.24$ pN/$\mu$m.
This results in a thermoelectric potential $U_{x}^{OTE}$ that is over eight
times deeper than the thermofluidic potential $U_{x}^{slip}$, trapping the
AuNP in the surface plane above the hotspot. Due to the elliptical shape of
the temperature distribution, as is evident from the contours in Figure 1(d),
the temperature gradients along Y are greater than those along X. This results
in steeper force profiles and a larger trap stiffness along Y, $k_{y}\sim
2k_{x}$, for both OTE and hydrodynamic slip forces as is shown in Figure 2(c).
Thus, AuNP diffusing in water will be driven toward the hotspot collectively
by $F_{x,y}^{OTE}$ and $F_{x,y}^{slip}$ (in-plane forces), which facilitate an
elliptical region of closely assembled AuNP above the hotspot. It should be
emphasized that temperature is the primary control parameter for both
thermofluidic and thermoelectric traps, as depicted by Figure 2(d) (for the
400 nm AuNP). The maximum slip velocity $v_{slip}$ varies linearly with
$\Delta T_{max}$ due to its dependence on temperature as
$\vec{v}_{slip}=\chi\nabla T/T$44, directly affecting the thermofluidic trap
stiffness $k_{x}^{slip}$, where, $\chi$ is the thermo-osmotic slip
coefficient. The rising temperature will also strengthen $E_{T}$, leading to a
stronger $F^{OTE}$ and increasing $k_{x}^{OTE}$. Figure 2(d) also shows that
$k_{x}^{slip}$ is one order of magnitude smaller than its thermoelectric
counterpart $k_{x}^{OTE}$. The y-components of the forces and potentials
exhibit a similar trend as the x-components but with steeper force profiles
and deeper potentials. Note that, up to an extent, $F^{OTE}$ can be increased
while keeping $F^{slip}$ constant by increasing the CTAC concentration,
enhancing $E_{T}$ and thus the forces. However, to calculate the precise
enhancement, we require zeta potential of AuNP in the increased concentration.
For further comparison, we will continue the analysis considering 5 mM
concentration of CTAC.

Figure 3: Hydrodynamic forces: (a) and (b) represent the $F_{x}^{slip}$ and
$F_{z}^{slip}$ forces on AuNP of different diameters. (c) Comparison between
$F_{z}^{slip}$ and $F_{z}^{OTE}$ forces showing their opposing nature. (d)
Variation of trap stiffness with AuNP diameter due to hydrodynamic slip and
convective forces. (e) XZ profile of slip and convective fluid flow, along
with contours showing temperature rise.

Optical field enhancement: SP, being evanescent fields, decay exponentially
away from the Au surface, which is why certain applications like biosensing
and Raman spectroscopy require the objects to be very close to the surface.
But, temperature-induced fluid flows like slip flow can pose a challenge. The
x- and z-components of hydrodynamic slip forces, $F_{x}^{slip}$ and
$F_{z}^{slip}$, on an AuNP located 20 nm above the surface are shown in
Figures 3(a) and 3(b), respectively. An increase in forces with particle size
is expected due to the smaller diffusion coefficient of larger particles and
the dependence of hydrodynamic forces on particle size. These sub-pN
$F^{slip}$ forces are sufficient to influence the Brownian dynamics of the
AuNP and result in a strong enough thermofluidic trap that can assemble AuNP
above the hotspot. However, the assembled AuNP are unable to interact with the
evanescent SP field due to the slightly stronger out-of-plane force
$F_{z}^{slip}$, which expels the AuNP out of the trap volume. This makes the
trap unstable in the vertical dimension. The instability is countered by the
negative $F_{z}^{OTE}$, as plotted in Figure 3(c), which is directed towards
the hotspot. It is seven times stronger than the positive $F_{z}^{slip}$,
effectively opposing the upward pull and enabling a stable trap in the
vertical dimension. Being closely confined to the surface, the particles can
interact with the evanescent SP fields and create subwavelength gaps where the
electric field can be localized and enhanced by multiple orders. Such
confinement is crucial for applications like plasmonic sensing 56 and multiple
scattering experiments like lasing from colloidal assemblies 57. Inferring
from Figure 2(d), large temperatures will tend to strengthen $F_{z}^{slip}$
fluidic forces, making the trap unstable at large powers. But, in the presence
of ions, the temperatures will also reinforce the thermoelectric field and
$F_{z}^{OTE}$ will facilitate stable trapping close to the surface. Hence,
evanescent-OTE trap facilitates stable potential at both low powers, when
thermofluidic potentials are shallow, and at high powers, when thermofluidic
traps are unstable.

Hydrodynamic convective forces: Hydrodynamic convective forces $F^{conv}$ are
calculated using the convective flow velocity $v_{conv}$ and are in the order
$10^{-2}-10^{-3}$ fN. Figure 3(d) compares the trap stiffness due to
$F_{x}^{conv}$ and $F_{x}^{slip}$ for different sizes of AuNP. While both
$k_{x}^{conv}$ and $k_{x}^{slip}$ increase with particle size, $k_{x}^{conv}$
shows a concave-up increase and $k_{x}^{slip}$ a concave-down increase. This
can be understood from the dependence of the hydrodynamic force on $\gamma$
and $v$. As the particle size increases, its center-to-surface distance
increases and $\gamma$ increases for both kinds of flows. However, from Figure
3(e), two distinct characteristics of $v$ can be observed: (1) $v_{slip}$ is
three orders of magnitude stronger than $v_{conv}$, and (2) $v_{slip}$ is
stronger near the interface while $v_{conv}$ is stronger in the bulk fluid,
that is, $v_{slip}$ decreases while $v_{conv}$ increases as we go higher in
$z$. This results in a steeper increase in $k_{x}^{conv}$ compared to a
flatter rise in $k_{x}^{slip}$. Despite such trends, the slip forces result in
a much stiffer trap, exceeding the trap stiffness due to convective forces by
atleast four orders of magnitude. From this, we can disregard the effect of
convective fluid flow on AuNP dynamics. Additionally, for smaller fluid
columns like the one considered here, the convective fluid flows are largely
suppressed, and slip fluid flow dominates the particle dynamics.

Figure 4: Schematic representing the different forces acting on an AuNP
suspended above an evanescently excited Au film.

Control parameters of the trap: A schematic of the resultant forces is shown
in Figure 4, depicting the respective forces acting in the system, mediated by
the temperature rise from laser heating in an evanescent-OTE trap. The primary
control parameter of both hydrodynamic and thermoelectric forces is the
temperature distribution, which depends on the SP intensity. Besides varying
SP intensity directly from the laser power, the polarization can be switched
between p- and s- to control the fraction of incident light converted to SP.
Also, illuminating at SPR angle can induce large temperature rise even at
small laser powers. The trap will vanish instantaneously upon the removal of
temperature gradients, making the assembly formation a reversible process.
Loosely focusing the laser at an oblique angle provides large-scale
illumination and temperature gradients over a large area, which dictates the
assembly dimension. Once the trap begins to form, the accumulated AuNP will
interact with the SP fields, leading to intensity enhancement. This will heat
the AuNP, acting as positive feedback that enhances the hydrodynamic and
thermoelectric effects. Moreover, thermoelectric forces can additionally be
controlled by the ionic concentration, given the direct dependence of the
thermoelectric field on concentration.

##  4 Conclusion

We have demonstrated the working mechanism of an evanescent-optothermoelectric
trap that can reversibly assemble metallic nanoparticles of any shape or
material on a large scale, with particle radius down to 50 nm. While the
simulations depict results for a smaller dimension, the same can be extended
to a larger scale to obtain similar results. Large-scale TIR-illumination can
access a large working area spanning hundreds of microns without using complex
experimental optics or delicate fabricated structures, giving large-scale trap
potentials. The potential depth depends on the temperature magnitude generated
due to the illumination and ionic concentration. The temperature magnitude is
controlled by incident power, polarization, and excitation angle. Since
optical forces are not the major player, the trap is independent of particle
characteristics and requires no resonance matching, wavelength tuning, high NA
lens, or high powers. While optically mediated hydrodynamic forces lead to a
thermofluidic trap, it is unstable in the vertical dimension. Whereas,
thermoelectric forces can be 10 times stronger than hydrodynamic forces and
facilitate deeper potentials to trap and assemble nanoparticles close to the
surface. Such closely assembled particles can achieve excellent electric field
enhancement, having direct applications in SERS 23. Careful tuning of
$F^{OTE}$ and $F^{slip}$ can result in applications like particle sorting
without the need for multiple lasers 25. Importantly, the large illumination
area ($\sim$sub-mm) results in very small intensities (tens of mW in hundreds
of $\mu$m2), yet enough to assemble nanoparticles on such a large scale 24,
compared to 0.1 mW/$\mu$m2 used to assemble over a few microns 53. Once the
assembly is formed, particles can self-heat, sustaining the trap even without
metal film. Such an assembly can potentially be transferred as a single entity
56. Moreover, dielectric particles can be trapped using this method despite
their thermophobic behavior 27. We anticipate large-area traps to be useful in
dynamic lithography of small entities such as Brownian colloids and bio-
macromolecules. The strategy can also confine larger biological entities such
as cells. This expands the capability of evanescent optical trapping from
molecular to cellular scale without incrementing laser powers.

The authors thank Dr. Sunny Tiwari, Dr. Diptabrata Paul, and Dr. Shailendra
Kumar Chaubey for valuable discussions related to this project. This work was
partially funded by AOARD (grant number FA2386-23-1-4054) and the
Swarnajayanti fellowship grant (DST/SJF/PSA-02/2017-18) to GVPK.

## References

  * Ashkin 1970 Ashkin, A. Acceleration and trapping of particles by radiation pressure. _Physical Review Letters_ 1970, _24_ , 156
  * Ashkin et al. 1986 Ashkin, A.; Dziedzic, J. M.; Bjorkholm, J. E.; Chu, S. Observation of a Single-Beam Gradient Force Optical Trap for Dielectric Particles. _Optics Letters_ 1986, _11_ , 288–290
  * Ashkin and Dziedzic 1987 Ashkin, A.; Dziedzic, J. M. Optical Trapping and Manipulation of Viruses and Bacteria. _Science_ 1987, _235_ , 1517–1520
  * Ashkin et al. 1987 Ashkin, A.; Dziedzic, J. M.; Yamane, T. Optical trapping and manipulation of single cells using infrared laser beams. _Nature_ 1987, _330_ , 769–771
  * Šiler et al. 2006 Šiler, M.; Čižmár, T.; Šerỳ, M.; Zemánek, P. Optical forces generated by evanescent standing waves and their usage for sub-micron particle delivery. _Applied Physics B_ 2006, _84_ , 157–165
  * Grier 2003 Grier, D. G. A Revolution in Optical Manipulation. _Nature_ 2003, _424_ , 810–816
  * Bradac 2018 Bradac, C. Nanoscale Optical Trapping: A Review. _Advanced Optical Materials_ 2018, _6_ , 1800005
  * Crozier 2019 Crozier, K. B. Quo Vadis, Plasmonic Optical Tweezers? _Light: Science & Applications_ 2019, _8_ , 35
  * Volpe et al. 2023 Volpe, G. et al. Roadmap for Optical Tweezers. _Journal of Physics: Photonics_ 2023, _5_ , 022501
  * Nalupurackal et al. 2023 Nalupurackal, G.; Murugan, G.; Lokesh, M.; Vaippully, R.; Chauhan, A.; Nanda, B. R. K.; Sudakar, C.; Kotamarthi, H. C.; Datta, P.; Sinha Mahapatra, P.; others Simultaneous optical trapping and electromagnetic micromanipulation of ferromagnetically doped nayf4 microparticles. _ACS Applied Optical Materials_ 2023, _1_ , 615–622
  * Panja et al. 2024 Panja, K.; Goswami, J.; Nalupurackal, G.; Chakraborty, S.; Roy, S.; Roy, B.; Singh, R. Nonlinear dynamics of a microparticle in a hydro-thermophoretic trap. _Results in Physics_ 2024, _61_ , 107709
  * Righini et al. 2008 Righini, M.; Girard, C.; Quidant, R. Light-Induced Manipulation with Surface Plasmons. _Journal of Optics A: Pure and Applied Optics_ 2008, _10_ , 093001
  * Yoon and Cicuta 2010 Yoon, Y.-Z.; Cicuta, P. Optical Trapping of Colloidal Particles and Cells by Focused Evanescent Fields Using Conical Lenses. _Optics Express_ 2010, _18_ , 7076–7084
  * Yu et al. 2007 Yu, X.; Torisawa, T.; Umeda, N. Manipulation of particles with counter-propagating evanescent waves. _Chinese Physics Letters_ 2007, _24_ , 2833
  * Lu et al. 2023 Lu, J.; Ginis, V.; Lim, S. W. D.; Capasso, F. Helicity and Polarization Gradient Optical Trapping in Evanescent Fields. _Physical Review Letters_ 2023, _131_ , 143803
  * Sasaki et al. 1997 Sasaki, K.; Tsukima, M.; Masuhara, H. Three-dimensional potential analysis of radiation pressure exerted on a single microparticle. _Applied Physics Letters_ 1997, _71_ , 37–39
  * Barnes et al. 2003 Barnes, W. L.; Dereux, A.; Ebbesen, T. W. Surface plasmon subwavelength optics. _Nature_ 2003, _424_ , 824–830
  * Zhang et al. 2021 Zhang, Y.; Min, C.; Dou, X.; Wang, X.; Urbach, H. P.; Somekh, M. G.; Yuan, X. Plasmonic Tweezers: For Nanoscale Optical Trapping and Beyond. _Light: Science & Applications_ 2021, _10_ , 59
  * Kang et al. 2015 Kang, Z.; Chen, J.; Wu, S.-Y.; Chen, K.; Kong, S.-K.; Yong, K.-T.; Ho, H.-P. Trapping and assembling of particles and live cells on large-scale random gold nano-island substrates. _Scientific reports_ 2015, _5_ , 9978
  * Kotsifaki and Chormaic 2019 Kotsifaki, D. G.; Chormaic, S. N. Plasmonic optical tweezers based on nanostructures: fundamentals, advances and prospects. _Nanophotonics_ 2019, _8_ , 1227–1245
  * Juan et al. 2011 Juan, M. L.; Righini, M.; Quidant, R. Plasmon nano-optical tweezers. _Nature Photonics_ 2011, _5_ , 349–356
  * Quidant and Girard 2008 Quidant, R.; Girard, C. Surface-plasmon-based optical manipulation. _Laser & Photonics Reviews_ 2008, _2_ , 47–57
  * Patra et al. 2014 Patra, P. P.; Chikkaraddy, R.; Tripathi, R. P.; Dasgupta, A.; Kumar, G. P. Plasmofluidic single-molecule surface-enhanced Raman scattering from dynamic assembly of plasmonic nanoparticles. _Nature Communications_ 2014, _5_ , 4357
  * Patra et al. 2016 Patra, P. P.; Chikkaraddy, R.; Thampi, S.; Tripathi, R. P.; Kumar, G. P. Large-scale dynamic assembly of metal nanostructures in plasmofluidic field. _Faraday discussions_ 2016, _186_ , 95–106
  * Cuche et al. 2013 Cuche, A.; Canaguier-Durand, A.; Devaux, E.; Hutchison, J.; Genet, C.; Ebbesen, T. Sorting nanoparticles with intertwined plasmonic and thermo-hydrodynamical forces. _Nano Letters_ 2013, _13_ , 4230–4235
  * Sharma et al. 2021 Sharma, V.; Tiwari, S.; Paul, D.; Sahu, R.; Chikkadi, V.; Kumar, G. P. Optothermal pulling, trapping, and assembly of colloids using nanowire plasmons. _Soft Matter_ 2021, _17_ , 10903–10909
  * Garcés-Chávez et al. 2006 Garcés-Chávez, V.; Quidant, R.; Reece, P.; Badenes, G.; Torner, L.; Dholakia, K. Extended organization of colloidal microparticles by surface plasmon polariton excitation. _Physical Review B_ 2006, _73_ , 085417
  * Volpe et al. 2006 Volpe, G.; Quidant, R.; Badenes, G.; Petrov, D. Surface plasmon radiation forces. _Physical Review Letters_ 2006, _96_ , 238101
  * Kotsifaki and Chormaic 2022 Kotsifaki, D. G.; Chormaic, S. N. The Role of Temperature-Induced Effects Generated by Plasmonic Nanostructures on Particle Delivery and Manipulation: A Review. _Nanophotonics_ 2022, _11_ , 2199–2218
  * Chen et al. 2021 Chen, Z.; Li, J.; Zheng, Y. Heat-mediated optical manipulation. _Chemical Reviews_ 2021, _122_ , 3122–3179
  * Kollipara et al. 2023 Kollipara, P. S.; Chen, Z.; Zheng, Y. Optical manipulation heats up: present and future of optothermal manipulation. _ACS Nano_ 2023, _17_ , 7051–7063
  * Kotnala et al. 2019 Kotnala, A.; Kollipara, P. S.; Li, J.; Zheng, Y. Overcoming diffusion-limited trapping in nanoaperture tweezers using opto-thermal-induced flow. _Nano Letters_ 2019, _20_ , 768–779
  * Sharma et al. 2020 Sharma, V.; Paul, D.; Chaubey, S. K.; Tiwari, S.; Kumar, G. P. Large-scale optothermal assembly of colloids mediated by a gold microplate. _Journal of Physics: Condensed Matter_ 2020, _32_ , 324002
  * Peng et al. 2020 Peng, X.; Chen, Z.; Kollipara, P. S.; Liu, Y.; Fang, J.; Lin, L.; Zheng, Y. Opto-thermoelectric microswimmers. _Light: Science & Applications_ 2020, _9_ , 141
  * Shukla et al. 2023 Shukla, A.; Tiwari, S.; Majumder, A.; Saha, K.; Kumar, G. V. P. Opto-Thermoelectric Trapping of Fluorescent Nanodiamonds on Plasmonic Nanostructures. _Optics Letters_ 2023, _48_ , 2937–2940
  * Wang et al. 2022 Wang, X.; Yuan, Y.; Xie, X.; Zhang, Y.; Min, C.; Yuan, X. Graphene-Based Opto-Thermoelectric Tweezers. _Advanced Materials_ 2022, _34_ , 2107691
  * Liu et al. 2018 Liu, Y.; Lin, L.; Bangalore Rajeeva, B.; Jarrett, J. W.; Li, X.; Peng, X.; Kollipara, P.; Yao, K.; Akinwande, D.; Dunn, A. K.; Zheng, Y. Nanoradiator-Mediated Deterministic Opto-Thermoelectric Manipulation. _ACS Nano_ 2018, _12_ , 10383–10392
  * Li and Zheng 2021 Li, J.; Zheng, Y. Optothermally Assembled Nanostructures. _Accounts of Materials Research_ 2021, _2_ , 352–363
  * Kotnala et al. 2020 Kotnala, A.; Kollipara, P. S.; Zheng, Y. Opto-Thermoelectric Speckle Tweezers. _Nanophotonics_ 2020, _9_ , 927–933
  * Kollipara et al. 2019 Kollipara, P. S.; Lin, L.; Zheng, Y. Thermo-Electro-Mechanics at Individual Particles in Complex Colloidal Systems. _The Journal of Physical Chemistry C_ 2019, _123_ , 21639–21644
  * Maier et al. 2007 Maier, S. A.; others _Plasmonics: fundamentals and applications_ ; Springer, 2007; Vol. 1
  * Baffou 2017 Baffou, G. _Thermoplasmonics: Heating Metal Nanoparticles Using Light_ ; Cambridge University Press, 2017
  * Wang et al. 2009 Wang, K.; Schonbrun, E.; Crozier, K. B. Propulsion of gold nanoparticles with surface plasmon polaritons: evidence of enhanced optical force from near-field coupling between gold particle and gold film. _Nano Letters_ 2009, _9_ , 2623–2629
  * Bregulla et al. 2016 Bregulla, A. P.; Würger, A.; Günther, K.; Mertig, M.; Cichos, F. Thermo-osmotic flow in thin films. _Physical Review Letters_ 2016, _116_ , 188303
  * Fränzl and Cichos 2022 Fränzl, M.; Cichos, F. Hydrodynamic manipulation of nano-objects by optically induced thermo-osmotic flows. _Nature communications_ 2022, _13_ , 656
  * Duhr and Braun 2006 Duhr, S.; Braun, D. Why Molecules Move along a Temperature Gradient. _Proceedings of the National Academy of Sciences_ 2006, _103_ , 19678–19682
  * Quidant et al. 2007 Quidant, R.; Zelenina, A.; Nieto-Vesperinas, M. Optical manipulation of plasmonic nanoparticles. _Applied Physics A_ 2007, _89_ , 233–239
  * Min et al. 2013 Min, C.; Shen, Z.; Shen, J.; Zhang, Y.; Fang, H.; Yuan, G.; Du, L.; Zhu, S.; Lei, T.; Yuan, X. Focused plasmonic trapping of metallic particles. _Nature Communications_ 2013, _4_ , 2891
  * Jones et al. 2015 Jones, P. H.; Maragò, O. M.; Volpe, G. _Optical Tweezers: Principles and Applications_ ; Cambridge University Press, 2015
  * Xu et al. 2018 Xu, Z.; Song, W.; Crozier, K. B. Direct particle tracking observation and Brownian dynamics simulations of a single nanoparticle optically trapped by a plasmonic nanoaperture. _ACS Photonics_ 2018, _5_ , 2850–2859
  * Chand et al. 2023 Chand, R.; Rani, C. E.; Paul, D.; Kumar, G. P. Emergence of Directional Rotation in an Optothermally Activated Colloidal System. _ACS Photonics_ 2023, _10_ , 4006–4013
  * Lin et al. 2018 Lin, L.; Wang, M.; Peng, X.; Lissek, E. N.; Mao, Z.; Scarabelli, L.; Adkins, E.; Coskun, S.; Unalan, H. E.; Korgel, B. A.; others Opto-thermoelectric nanotweezers. _Nature Photonics_ 2018, _12_ , 195–201
  * Lin et al. 2016 Lin, L.; Peng, X.; Wang, M.; Scarabelli, L.; Mao, Z.; Liz-Marzán, L. M.; Becker, M. F.; Zheng, Y. Light-directed reversible assembly of plasmonic nanoparticles using plasmon-enhanced thermophoresis. _ACS Nano_ 2016, _10_ , 9659–9668
  * Ohsawa et al. 1986 Ohsawa, K.; Murata, M.; Ohshima, H. Zeta potential and surface charge density of polystyrene-latex; comparison with synaptic vesicle and brush border membrane vesicle. _Colloid and Polymer Science_ 1986, _264_ , 1005–1009
  * Brenner 1961 Brenner, H. The slow motion of a sphere through a viscous fluid towards a plane surface. _Chemical Engineering Science_ 1961, _16_ , 242–251
  * Tiwari et al. 2021 Tiwari, S.; Khandelwal, U.; Sharma, V.; Kumar, G. P. Single molecule surface enhanced Raman scattering in a single gold nanoparticle-driven thermoplasmonic tweezer. _The Journal of Physical Chemistry Letters_ 2021, _12_ , 11910–11918
  * Trivedi et al. 2022 Trivedi, M.; Saxena, D.; Ng, W. K.; Sapienza, R.; Volpe, G. Self-organized lasers from reconfigurable colloidal assemblies. _Nature Physics_ 2022, _18_ , 939–944