Microarchitecture-aware Fault Models: Experimental Evidence and Cross-Layer Inference Methodology

Fault injection attacks (FIAs) are becoming a serious threat to the security of integrated circuits (ICs). Circuit designers need a simple and effective method to evaluate the ability of their IC designs against the FIAs at design stage. To address the need, this paper based on FPGA emulation proposes a method, which mimics FIAs on a circuit design implemented on a FPGA by instantiating a uniform architecture which can generate different fault models and span the space of faults and inserting fault injection logic into the design. After the circuit design is submitted to the emulation platform, the fault generation and injection are executed automatically, and a report about the ability of the IC design against the FIAs is generated. The method works at the circuit netlist level, leaves the source codes of the circuit design unmodified, and makes the evaluation a transparent process to the designers. The experiment with various fault models and differential fault analysis on AES-128 encryption circuit shows the effectiveness of the method.

Fault injection attacks pose serious threat in security of embedded devices since they require less expertise to conduct them. Suitable countermeasures can only be built if there effects are studied and analyzed in detail. This paper presents circuits which produces power fault injection attack (positive, negative, positive/negative) through voltage glitching on cadence 180 nm technology node. Additionally, it presents a VHDL code for generating clock fault (overclocking and underclocking attacks) injection attack. Effect of power and clock fault injection attacks is analyzed on combinational circuits. Techniques presented in this paper can be used as testing platforms for doing analysis of fault injection attacks on different combinational and sequential circuits so that countermeasures can be built in future in order to have attack-resistant devices. The paper emphasizes the perspective from the attacker, rather than the perspective of countermeasure development.

Cryptographic implementations are prune to Side Channel Analysis (SCA) attacks and Fault Injection (FI) attacks at the same time. Therefore, countermeasures protecting an implementation need to be evaluated against both attacks. The main contribution of this work is twofold. First, we propose an evaluation platform capable to perform emulated fault injection campaigns against modern MCUs and at the same time able to acquire experimental electromagnetic EM emissions and power traces of cryptographic computations to be used for SCA attacks. Second, we perform experimental evaluations of countermeasures protecting against both SCA and FI attacks which show that the injections of faults can dramatically reduce the effectiveness of SCA countermeasures. We evaluate two cryptographic algorithms, an AES and a PRESENT-Sbox implementation, which are protected employing different countermeasures protecting in parallel against FI and SCA attacks. The AES secure implementation is protected by hiding-based SCA countermeasures, while it uses a redundancy-based technique against FI attacks. On the other hand, the PRESENT Sbox is protected by a software implementation of a Dual-rail with Precharge Logic (DPL) countermeasure including fault detection capabilities. We present extensive experimental evaluations for the AES implementation and first results for PRESENT-Sbox showing that for both implementations the fault injections increase the efficiency of the SCA attacks and lead to very fast recoveries of the secret keys.

Fault injection is a well-established technique in the research community that consists of emulating faults in order to obtain dependability-related data. Despite its potential, fault injection has been less widely adopted outside of academia, due to the expertise required to effectively conduct fault injection campaigns and to the lack of tools that can be easily adapted to different systems. This paper presents ucXception, an easy-to-install, extendable, open-source framework for orchestrating the entire lifecycle of fault injection campaigns without requiring expert knowledge and using a graphical interface. ucXception supports injection of software and hardware faults using realistic fault models and can be applied to a variety of target systems, including virtualized systems and complex cloud computing deployments. This brings fault injection to modern environments of cloud computing. As a use case, a preliminary analysis on the usage of failure models as a valid alternative to fault models is performed.

Emerging Non-Volatile Memories (NVMs) suffer from high and asymmetric read/write current and long write latency which can result in supply noise such as supply voltage droop and ground bounce. The magnitude of supply noise depends on the old data and the new data that is being written (for write operation) or on the stored data (for read operation). In this paper, we show that the adversary can write specific data pattern (that results in deterministic supply noise) in their memory space to launch, i) Denial of Service (DoS) attack (total write failure), and ii) specific polarity fault (i.e., fault injection) attack in victim's memory space sharing the same power rails with the adversary's memory space. These attacks are specifically possible if exhaustive testing of the memory for all patterns, all possible location combinations, all possible parallel read/write conditions are not performed under bit-to-bit process variations and, specified (−10°C to 90°C) and unspecified temperature ranges (i.e., less than -10°C and greater than 90°C). Simulation result indicates that adversary can launch DoS attack on victim's write operation by injecting more than 120mV of supply noise to victim's write location. The adversary can also launch 0 → 1 polarity fault injection attack on victim's write operation by injecting supply noise greater than 50mV but shorter than 120mV to victim's write location. Furthermore, the adversary can cause data '1' read failure by injecting more than 150mV of supply noise to victim's read location.

Fault-injection (FI) attacks exploit corrupted ciphertexts from cryptographic engines to extract secret keys. A single fault injected into the penultimate AES round using directed laser pulses or voltage/clock glitches corrupts 4 output bytes (Fig. 15.5.1), reducing key search space to a single guess with differential fault analysis (DFA) on 8 exploitable ciphertexts. FI countermeasures using redundant concurrent/time-interleaved computations incur 2x area/performance overheads [1], [3]. Conventional linear parity checkers [2] provide insufficient fault coverage due to the non-linear characteristics of Sbox inverse operations. FI detection-based countermeasures, employing source-specific detectors such as substrate-current sensors [4] for laser attacks and frequency-locked loops [5] to detect clock glitches, respectively are ineffective against generic FI attacks. In this paper, we present a source-agnostic FI-attack resistant AES-256 accelerator with <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$111\times$</tex> and <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$10,000\times$</tex> improvement in minimum-time-to-disclose (MTD) against laser and undervoltage attacks, respectively compared to an unprotected AES engine. Arithmetic and parity-based checker circuits coupled with inverse and affine logic optimizations and byte-interleaved register placement enable 99.1% fault coverage against laser raster/box-scan injections (Fig. 15.5.1). Fine-grained placement of an all-digital laser detection circuit (LDC) within the AES core provides <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$13,400\times$</tex> higher margin for raster-scan laser pulse detections. Undervoltage attacks on FI-resistant AES show a measured 99.99% fault detection coverage and a <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$40\text{mV}$</tex> positive slack in checker datapath to capture undervoltage faults.

Fault injection attacks rely on experimental techniques to inject one or several faults into a device during operation. Among these techniques, laser fault injection is known as a powerful one, thanks to its unmatched spatial and temporal precision. So far though, the overwhelming majority of published laser fault injection attacks were performed with only one laser spot. In this article, we present a new multi-spot laser fault injection setup. After a description of the optical system, we highlight its new capabilities against the limitations of existing single-spot laser fault injection setups. We then discuss some intrinsic limitations that this setup has, making it not equivalent to running multiple single-spot setups simultaneously on the same target. We then provide experimental evidence of faults performed with two and four spots which are unfeasible with a single-spot laser fault injection setup. This paves the way for new fault attacks on security and cryptography algorithms that exploit this new type of fault.

Electromagnetic fault injection (EMFI) attack has posed serious threats to the security of integrated circuits. Memory storing sensitive codes and data has become the first choice of attacking targets. This work performs a thorough characterization of the induced faults and the associated fault model of EMFI attacks on DRAM. Specifically, we firstly carry out a set of experiments to analyse the sensitivity of various types of memory to EMFI. The analysis shows that DRAM is more sensitive to EMFI than EEPROM, Flash, and SRAM in this experiment. Then, we classify the induced faults in DRAM and formulate the fault models. Finally, we find the underlying reasons that explain the observed fault models by circuit-level simulation of DRAM under EMFI. The in-depth understanding of the fault models will guide design of DRAM against EMFI attacks.

Technology advances provide today the capability of integrating large Iterative Logic Arrays (ILAs) in the same chip. Traditional combinational fault models are not sufficient to detect all failures in CMOS ILAs. Robust test generation for sequential faults in ILAs has not been considered in the literature. Two-pattern tests for sequential fault detection in ILAs can be invalidated either at the cell level due to arbitrary delays inside the cells or at the array level due to the appearance of glitches at the cell inputs. A realistic sequential fault model for any type of ILA is introduced. The fault model along with algorithms for the elimination of glitches in one-dimensional ILAs provide a comprehensive methodology for robust sequential fault testing. C-testability and linear-testability are seeked to provide efficient test sets. Results of the implementation of the method on a comprehensive set of benchmark one-dimensional ILAs are provided. Test complexity and thus test cost is greatly reduced compared to exhaustive two-pattern testing proposed in the past for sequential fault testing in ILAs.

Implementations of cryptographic algorithms continue to proliferate in consumer products due to the increasing demand for secure transmission of confidential information. Although the current standard cryptographic algorithms proved to withstand exhaustive attacks, their hardware and software implementations have exhibited vulnerabilities to side channel attacks, e.g., power analysis and fault injection attacks. This paper focuses on fault injection attacks that have been shown to require inexpensive equipment and a short amount of time. The paper provides a comprehensive description of these attacks on cryptographic devices and the countermeasures that have been developed against them. After a brief review of the widely used cryptographic algorithms, we classify the currently known fault injection attacks into low-cost ones (which a single attacker with a modest budget can mount) and high-cost ones (requiring highly skilled attackers with a large budget). We then list the attacks that have been developed for the important and commonly used ciphers and indicate which ones have been successfully used in practice. The known countermeasures against the previously described fault injection attacks are then presented, including intrusion detection and fault detection. We conclude the survey with a discussion on the interaction between fault injection attacks (and the corresponding countermeasures) and power analysis attacks.

The Groningen field is the largest onshore gas field in Europe. The gas-bearing section comprises aeolian and fluvial Rotliegend sandstones of Permian age and fluvial sandstones of Carboniferous age. Continuous production since 1963 has led to induced seismicity starting in the early 1990s.Faults at reservoir level play a major role in the seismicity in the Groningen field. Fault slip is expected when shear traction is sufficient to overcome frictional resistance on the fault surface. Clear insights into which faults and fault segments are most susceptible to seismicity could be used to optimise production and minimise the seismic risk. To gain these insights, a detailed and realistic fault model is required as input to both statistical analyses on seismicity and deterministic geomechanical modelling of seismogenic behaviour along fault planes. Geometrical seismic attributes and, subsequently, fault planes were extracted from a reprocessed and depth-imaged 3D seismic volume. This resulted in a detailed visualisation of the faults at reservoir level, with extension into the deeper strata below the reservoir in many cases. They represent fault planes with realistic dimensions and shapes. The fault map based on seismic attributes suggests the presence of faults that have not been included in studies on Groningen seismicity before. The improved fault definition correlates with recent earthquake hypocentres. We conclude that a detailed fault model of the Groningen field can be created using 3D seismic attributes and that detailed 3D fault planes can be extracted from these attributes. The results can be used as input to statistical and geomechanical analyses on seismicity.

Fault injection attacks have become a serious threat against cryptographic ICs. The existing countermeasures rely on error detection and correction, which brings a large area and power overhead. This paper proposes a security enhancement design method against fault injection attacks, which selectively protects or detects only the vulnerable logic cells in a cryptographic circuit. These vulnerable cells of the cryptographic ICs can be accurately identified on the system level and the security enhancement will be conducted only on these cells on the circuit level. This security enhancement design method has the advantages of smaller area and power overheads, transparency to the IC designers and compatibility to the common electronic design automation (EDA) tools.

We study numerically the behavior of a two-dimensional elastic plate (a crustal plane) that terminates along one of its edges at a fault boundary. Slip-weakening friction at the boundary, inertial dynamics in the bulk, and uniform slow loading via elastic coupling to a substrate combine to produce a complex, deterministically chaotic sequence of slipping events. We observe a power-law distribution of small events and an excess of large events. For the small events, the moments scale with rupture length in a manner that is consistent with seismological observations. For the large events, rupture occurs in the form of narrow propagating pulses. [S0031-9007(96)00703-X] PACS numbers: 91.30.Bi, 03.40.Dz, 05.45. + b, 64.60.Ht The discovery of dynamic complexity in the uniform, one-dimensional Burridge-Knopoff (BK) model of an earthquake fault [1,2] has brought new urgency to some questions about models of seismic sources. Perhaps the most pressing of these questions concerns the role of elasticity in the crustal plane—an ingredient that is necessarily missing in any one-dimensional model but which must be important for an understanding of the dynamics of slipping events. Off-fault elasticity is relevant to many features of real earthquake faults such as stress concentrations at rupture fronts, long-range elastic interactions, and seismic radiation. Previous studies [3‐7] indicate the following: The completely uniform, one-dimensional BK model, with velocity-weakening stick-slip friction, is a deterministically chaotic dynamical system that exhibits a broad range of earthquake-like events. The frequency-magnitude distribution for these events includes a scaling region of small localized events that is qualitatively similar to a Gutenberg-Richter (GR) law [8], and a region of large delocalized events whose frequency exceeds that of the extrapolated GR law and which account for most of the moment release. The large events propagate along the fault at roughly the sound speed in the form of “Heaton pulses” [9]. In order to be well posed mathematically, the model requires a cutoff or an ad hoc mechanism for initiating rupture at very small length scales. The questions of whether such mechanisms imply inherent discreteness of these models and whether that discreteness, in turn, implies the need for small-scale heterogeneity in realistic fault models are beyond the scope of this investigation. The important point is that the large-scale properties—complexity of large events and existence of a GR regime—are independent of the discretization length or the heterogeneity scale, and therefore appear to be robust features of this class of models. Our purpose in the investigations reported here has been to test the above features of the one-dimensional BK models in a two-dimensional model that includes elasticity in the crustal plane. Like the one-dimensional models, our two-dimensional model is still a caricature of the physically realistic situation, but it brings us a large step closer to an understanding of the dynamic behavior of this class of systems. It remains unrealistic in at least two respects, both of which are dictated by computational feasibility. First, our crustal plane is an elastic plate that moves only normal to itself and is coupled elastically to a rigid substrate. In this way, we obtain an essential simplification of our equations of motion and retain a very important dynamic time scale associated with coupling

Fault injection attacks (FIA), which cause information leakage by injecting intentional faults into the data or operations of devices, are one of the most powerful methods compromising the security of confidential data stored on these devices. Previous studies related to FIA on software report that attackers can skip instructions running on many kinds of devices through many means of fault injection. Most existing anti-FIA countermeasures on software are designed to secure against instruction skip (IS). On the other hand, recent studies report that attackers can use laser fault injection to manipulate instructions running on devices as they want. Although the previous studies show that instruction manipulation (IM) can attack the existing countermeasures against IS, no effective countermeasures against IM have been proposed yet to the best of our knowledge. In this paper, we define an attacker's model under the assumption that the attacker injects IM using a single-spot laser, and propose a coding method to verify data integrity secure against the assumed IM model in ARM 16-bit Thumb instruction set.

Fault injection attacks have posed serious threat to cryptographic integrated circuits (crypto-ICs). Heavy ion is one of the most powerful fault injection source due to its high energy and focused beam sizes. However, the ion has to strike on the certain transistor at the exact time instances. We choose the certain transistor among tens of thousands of transistors on the chip. And we choose the exact time instances during the whole decryption period. Only this kind of hit can cause a successful ion fault attack on crypto-ICs. The success rate is niche and often highly relies on experiences. This paper proposes a prediction model considering the ion density, crypto-ICs and the cryptographic algorithms. The model helps to indicate the appropriate Poisson intensity and beam spot size to maximize the success rate, so as to ease the ion fault injection test. Experimental results prove the feasibility of our model.