Comprehensive analysis of software countermeasures against fault attacks

Physical attacks, such as fault attacks, pose a decisive threat for the security of devices in the Internet of Things. An important class of countermeasures for fault attacks is fault tolerant software that is applicable for systems based on COTS hardware. In order to evaluate software countermeasures against fault attacks, fault injection is needed. However, established fault injection approaches require manufactured products or hardware details (e.g. netlists, RTL models), which are not available when using COTS hardware. In this paper, we present a QEMU-based fault injection platform that supports commercial COTS processors that are widely-used in the embedded domain. This framework allows a system-level analysis of software countermeasures by featuring the simulation of high-level hardware faults targeting, for example, memory cells, register cells, or the correct execution of instructions. The framework supports the generation of realistic fault attack scenarios. We illustrate the practicability of the approach by presenting two exemplary use cases.

In-memory key-value stores are often used to speed up Big Data workloads on modern HPC clusters. To maintain their high availability, erasure coding has been recently adopted as a low-cost redundancy scheme instead of replication. Existing erasure-coded update schemes, however, have either low performance or high memory overhead. In this paper, we propose a novel parity logging-based architecture, HybridPL, which creates a hybrid of in-place update (for data and XOR parity chunks) and log-based update (for the remaining parity chunks), so as to balance the update performance and memory cost, while maintaining efficient single-failure repairs. We realize HybridPL as an in-memory key-value store called LogECMem, and further design efficient repair schemes for multiple failures. We prototype LogECMem and conduct experiments on different workloads. We show that LogECMem achieves better update performance over existing erasure-coded update schemes with low memory overhead, while maintaining high basic I/O and repair performance.

In the 1970s researchers noticed that radioactive particles produced by elements naturally present in packaging material could cause bits to flip in sensitive areas of electronic chips. Research into the effect of cosmic rays on semiconductors, an area of particular interest in the aerospace industry, led to methods of hardening electronic devices designed for harsh environments. Ultimately various mechanisms for fault creation and propagation were discovered, and in particular it was noted that many cryptographic algorithms succumb to so-called fault attacks. Preventing fault attacks without sacrificing performance is nontrivial and this is the subject of this book. Part I deals with side-channel analysis and its relevance to fault attacks. The chapters in Part II cover fault analysis in secret key cryptography, with chapters on block ciphers, fault analysis of DES and AES, countermeasures for symmetric-key ciphers, and countermeasures against attacks on AES. Part III deals with fault analysis in public key cryptography, with chapters dedicated to classical RSA and RSA-CRT implementations, elliptic curve cryptosystems and countermeasures using fault detection, devices resilient to fault injection attacks, lattice-based fault attacks on signatures, and fault attacks on pairing-based cryptography. Part IV examines fault attacks on stream ciphers and how faults interact with countermeasures used to prevent power analysis attacks. Finally, Part V contains chapters that explain how fault attacks are implemented, with chapters on fault injection technologies for microprocessors, and fault injection and key retrieval experiments on a widely used evaluation board. This is the first book on this topic and will be of interest to researchers and practitioners engaged with cryptographic engineering.

In space radiation environment, a large number of cosmic ray often results in transient faults on on-board computer. These transient faults lead to data flow errors or control flow errors during program running. For the control flow errors caused by transient faults, this paper proposes a control flow checking method based on classifying basic blocks CFCCB. CFCCB firstly classifies the basic blocks based on the control flow graph that has been inserted the abstract blocks. CFCCB then designs formatted signatures for the basic blocks and inserts the instructions for comparing and update signatures into every basic block for the purpose of checking the control flow errors that are inter-blocks, intra-blocks or inter-procedures. Compared to existing algorithms, CFCCB not only has high label express ability, but also can be configured flexibly. The fault injection experiment results of CFCCB and other similar algorithms have shown that, the average fail rate of programs with CFCCB has decreased to 19.9% at the cost of increasing the executing time by 34% and increasing the memory overhead by 41.5% in average. CFCCB has lower performance and memory overhead, and has highest reliability among the similar algorithms.

This paper proposes a fault analysis technique on LED by combining algebraic cryptanalysis and differential fault analysis (DFA). The technique is called algebraic differential fault analysis (ADFA). In ADFA on LED, we use DFA to deduce the possible fault differences of the correct and faulty S-Box input in the last round, and convert them into algebraic equations. We then combine the equation set of LED with the injected fault and use the CryptoMiniSat solver to recover the secret key. Our experiments show that, on a common PC, ADFA can succeed on LED under the nibble-based fault model within three minutes and with only one fault injection, which is more efficient than previous DFA work. To evaluate DFA on LED, we first propose an improved evaluation algorithm of DFA, then provide a modified ADFA approach to compute the solutions for the secret key. The results are more accurate than previous work. We also successfully extend ADFA on LED to other fault models using a single fault injection, where traditional DFAs are difficult to launch.

The development of differential fault analysis (DFA) techniques and mechanisms to inject faults into cryptographic circuits brings with it the need to use protection mechanisms that guarantee the expected level of security. The AES cipher, as a standard, has been the target of numerous DFA techniques, where its security has been compromised through different formulations and types of fault injections. These attacks have shown vulnerabilities of different AES implementations and building blocks. Consequently, several solutions have been proposed that provide additional protection to cover the identified vulnerabilities. In this paper, an extensive analysis has been carried out covering the existing fault injection techniques, the types of faults, and the requirements needed to apply DFA. Additionally, an analysis of the countermeasures reported in the literature is also presented, considering the protection provided, the type of faults considered, and the coverage against fault attacks. The eight different types of fault that allow us to perform DFAs on the AES cipher have been differentiated, as well as the vulnerabilities of the cipher. On the other hand, two comparisons have been made considering frequency penalty vs. area and fault coverage vs. area and frequency overhead. A metric has been proposed to compare the fault coverage of all the proposed solutions. To conclude, a final analysis is presented discussing the key aspects when choosing a particular solution and the possible development of new countermeasures to provide further protection against DFA.

ARTINALI#: An Efficient Intrusion Detection Technique for Resource-Constrained Cyber-Physical Systems

Fault injection attacks (FIAs) are becoming a serious threat to the security of integrated circuits (ICs). Circuit designers need a simple and effective method to evaluate the ability of their IC designs against the FIAs at design stage. To address the need, this paper based on FPGA emulation proposes a method, which mimics FIAs on a circuit design implemented on a FPGA by instantiating a uniform architecture which can generate different fault models and span the space of faults and inserting fault injection logic into the design. After the circuit design is submitted to the emulation platform, the fault generation and injection are executed automatically, and a report about the ability of the IC design against the FIAs is generated. The method works at the circuit netlist level, leaves the source codes of the circuit design unmodified, and makes the evaluation a transparent process to the designers. The experiment with various fault models and differential fault analysis on AES-128 encryption circuit shows the effectiveness of the method.

Faults attacks are a serious threat to secure devices, because they are powerful and they can be performed with extremely cheap equipment. Resistance against fault attacks is often evaluated directly on the manufactured devices, as commercial tools supporting fault evaluation do not usually provide the level of details needed to assert the security of a device. Early identification of weak points would instead be very useful as it would allow to immediately apply the appropriate countermeasures directly at design time. Moving towards this goal, in this work, we survey existing fault attacks and techniques for injecting faults, and we analyze the suitability of existing electronic design automaton commodities for estimating resistance against fault attacks. Our exploration, which includes the type of attacks that can be simulated and the limitations of each considered simulation approach, is an initial step towards the development of a complete framework for asserting fault attack robustness.

The incorporation of error detection and recovery mechanisms becomes mandatory as the probability of the occurrence of transient faults increases. The detection of control flow errors has been extensively investigated in literature. However, only few works have been conducted towards recovery from control-flow errors. Generally, a program is re-executed after error detection. Although re-execution prevents faults from corrupting data, it does not allow the application to run to completion correctly in the presence of an error. Moreover, the overhead of re-execution increases prominently. The current study presents a pure-software method based on encoded signatures to recover from control-flow errors. Unlike general signature monitoring techniques, the proposed method targets not only interblock transitions, but also intrablock and inter-function transitions. After detecting the illegal transition, the program flow transfers back to the block where the error occurred, and the data errors caused by the error propagation are recovered. Fault injection and performance overhead experiments are performed to evaluate the proposed method. The experimental results show that most control flow errors can be recovered with relatively low performance overhead.

Recently, various studies of attack methods of round reduction differential fault analysis (DFA) using fault injection in block cipher-implemented microcontrollers have been reported. However, few studies have focused on the quantitative evaluation method of round reduction DFA vulnerability using detailed fault injection timing dependency of attack success rate. This is required to improve microcontroller security. Hence, we propose a quantitative evaluation method against round reduction DFA using a micro step DFA vulnerability chart and a vulnerability estimator (VE) that consists of pairs of fault injection timing and attack success rate.

Fault-injection (FI) attacks exploit corrupted ciphertexts from cryptographic engines to extract secret keys. A single fault injected into the penultimate AES round using directed laser pulses or voltage/clock glitches corrupts 4 output bytes (Fig. 15.5.1), reducing key search space to a single guess with differential fault analysis (DFA) on 8 exploitable ciphertexts. FI countermeasures using redundant concurrent/time-interleaved computations incur 2x area/performance overheads [1], [3]. Conventional linear parity checkers [2] provide insufficient fault coverage due to the non-linear characteristics of Sbox inverse operations. FI detection-based countermeasures, employing source-specific detectors such as substrate-current sensors [4] for laser attacks and frequency-locked loops [5] to detect clock glitches, respectively are ineffective against generic FI attacks. In this paper, we present a source-agnostic FI-attack resistant AES-256 accelerator with <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$111\times$</tex> and <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$10,000\times$</tex> improvement in minimum-time-to-disclose (MTD) against laser and undervoltage attacks, respectively compared to an unprotected AES engine. Arithmetic and parity-based checker circuits coupled with inverse and affine logic optimizations and byte-interleaved register placement enable 99.1% fault coverage against laser raster/box-scan injections (Fig. 15.5.1). Fine-grained placement of an all-digital laser detection circuit (LDC) within the AES core provides <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$13,400\times$</tex> higher margin for raster-scan laser pulse detections. Undervoltage attacks on FI-resistant AES show a measured 99.99% fault detection coverage and a <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$40\text{mV}$</tex> positive slack in checker datapath to capture undervoltage faults.

Algebraic fault analysis (AFA), which combines algebraic cryptanalysis with fault attacks, has represented serious threats to the security of lightweight block ciphers. Inspired by an earlier framework for the analysis of side-channel attacks presented at EUROCRYPT 2009, a new generic framework is proposed to analyze and evaluate algebraic fault attacks on lightweight block ciphers. We interpret AFA at three levels: the target, the adversary, and the evaluator. We describe the capability of an adversary in four parts: the fault injector, the fault model describer, the cipher describer, and the machine solver. A formal fault model is provided to cover most of the current fault attacks. Different strategies of building optimal equation set are also provided to accelerate the solving process. At the evaluator level, we consider the approximate information metric and the actual security metric. These metrics can be used to guide adversaries, cipher designers, and industrial engineers. To verify the feasibility of the proposed framework, we make a comprehensive study of AFA on an ultra-lightweight block cipher called LBlock. Three scenarios are exploited which include injecting a fault to encryption, to key scheduling, or modifying the round number or counter. Our best results show that a single fault injection is enough to recover the master key of LBlock within the affordable complexity in each scenario.

Fault injection attacks are powerful cryptanalysis techniques against the Advanced Encryption Standard (AES) algorithm. These attacks are based on injecting faults into the structure of the AES to obtain confidential information. To protect the AES implementation against these attacks, a number of countermeasures have been proposed. In this paper, we proposed a fault detection scheme, based on the information redundancy, for the AES. We discuss the strengths and the weaknesses of this scheme against the fault attacks. Moreover, we conduct a comparative study between fault detection schemes from the literature in terms of fault detection capabilities and implementation cost. The simulation results show that the fault coverage achieves 99.998% for the proposed scheme. Moreover, the proposed detection scheme has been implemented on Xilinx Virtex-5 FPGA. Its fault coverage, area overhead, throughput and frequency degradation have been compared and it is shown that the proposed scheme allows a trade-off between the hardware overhead and the security of the AES.

The increasing rate of transient faults necessitates the use of on-chip fault-tolerant techniques in embedded microprocessors. Performance overhead is a challenging problem in on-chip fault-tolerant techniques used in the random logic of the embedded microprocessors. This paper presents a signature-based error detection and roll-back recovery technique for the control logic with much lower performance overhead as compared to many previous techniques. The low performance overhead is achieved by eliminating the fault masking overhead cycles in the previous techniques. The performance overhead is analytically studied, and the analytical results recommend at which fault rate the use of the technique is preferred. To measure the cycle time of the pipeline critical path and area overhead, this technique has been implemented and synthesized using a behavioral VHDL model of the Leon2 processor. The synthesis results show that the area and the cycle time overhads of the technique are only 17.7% and 3.4%, respectively. In addition, the injection of about 74000 transient single bit-flip faults into the control logic part of the Leon2 processor shows that the technique detected about 99% of the injected faults.