Design Considerations for EM Pulse Fault Injection

Beckers, Arthur; Kinugawa, Masahiro; Hayashi, Yu-ichi; Fujimoto, Daisuke; Balasch, Josep; Gierlichs, Benedikt; Verbauwhede, Ingrid

doi:10.1007/978-3-030-42068-0_11

Cited by 9 publications

(8 citation statements)

References 8 publications

(12 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Thus, evaluation teams and research groups spent a fair amount of time developing EMFI injection setups and often resorted to EMFI when targeting various ICs. Based on the available testimonies [8], [9], [10], [11] these attempts (after sustained efforts) to extract the secret data using EMFI have turned out to be successful in all cases.…”

Section: Contextmentioning

confidence: 99%

(Adversarial) Electromagnetic Disturbance in the Industry

Beckers

Guilley

Maurine

et al. 2023

IEEE Trans. Comput.

View full text Add to dashboard Cite

Faults occur naturally and are responsible for reliability concerns. Faults are also an interesting tool for attackers to extract sensitive information from secure chips. In particular, non-invasive fault attacks have received a fair amount of attention. One easy way to perturb a chip without altering it is the so-called Electromagnetic Fault Injection (EMFI). Such attack has been studied in great depth, and nowadays, it is part and parcel of the state-of-the-art. Indeed, new capabilities have emerged where EM experimental benches are used to cryptanalyze chips. The progress of this "field" is fast, in terms of reproducibility, accuracy, and number of use-cases. However, there is too little awareness about such advances. In this paper, we aim to expose the true harmfulness of EMFI (including reproducibility) to enable reasonable security quotations. We also analyze protections (at hardware/firmware/system levels) in light of their efficiency. We characterize the specificity of EM fault injection compared to other injection means (laser, glitch, probing).

show abstract

Section: Contextmentioning

confidence: 99%

(Adversarial) Electromagnetic Disturbance in the Industry

Beckers

Guilley

Maurine

et al. 2023

IEEE Trans. Comput.

View full text Add to dashboard Cite

show abstract

“…3 A near-field injection probe can either be bought (cost here would be a couple of hundred USD) or manufactured from very low-cost components. Several research articles explore the possibility of a custom probe design [52], [53], [54]. Generally, a ferrite core, a copper wire, a connector, and a heat shrinking tube are enough to create a custom probe (depicted in Figure 4).…”

Section: Electromagnetic Fault Injectionmentioning

confidence: 99%

How Practical Are Fault Injection Attacks, Really?

Breier

Hou

2022

IEEE Access

View full text Add to dashboard Cite

Fault injection attacks (FIA) are a class of active physical attacks, mostly used for malicious purposes such as extraction of cryptographic keys, privilege escalation, attacks on neural network implementations. There are many techniques that can be used to cause the faults in integrated circuits, many of them coming from the area of failure analysis. In this paper we tackle the topic of practicality of FIA. We analyze the most commonly used techniques that can be found in the literature, such as voltage/clock glitching, electromagnetic pulses, lasers, and Rowhammer attacks. To summarize, FIA can be mounted on most commonly used architectures from ARM, Intel, AMD, by utilizing injection devices that are often below the thousand dollar mark. Therefore, we believe these attacks can be considered practical in many scenarios, especially when the attacker can physically access the target device.INDEX TERMS Hardware security, fault injection attacks, fault analysis, cryptography.

show abstract

“…Multiple EM-FI setups have been described in literature. These setups are either commercial [8]- [10] or academic in nature [11]- [13]. They all have in common that their construction is centered around a semi-conductor based switching element.…”

Section: A Previous Workmentioning

confidence: 99%

“…One can either store the energy capacitively or inductively. In the literature we can find examples for both cases using discrete components such as capacitors [13] or inductors [12]. In this work however we do not use a discrete component as storage element, but rather a continuous one in the form of a transmission line [15].…”

Section: A Energy Storagementioning

confidence: 99%

Design and Evaluation of a Spark Gap Based EM-fault Injection Setup

Beckers

Kinugawa

Hayashi

et al. 2020

2020 IEEE International Symposium on Electromagnetic Compatibility &Amp; Signal/Power Integrity (EMCSI)

Self Cite

View full text Add to dashboard Cite

The rapid and widespread deployment of electronic devices operating in the field is bringing security issues into the spotlight. Fault injection, for instance, is a class of attacks that allows adversaries to bypass security-related capabilities by tampering with the normal functioning of a device. In this paper we describe a setup capable of faulting integrated circuits by exposing them to a pulsed magnetic field. The magnetic field is generated by discharging a pulse forming network made from a transmission line over an injection probe. The discharge is triggered by a spark gap based switch. We describe the mechanisms behind the different circuit components and evaluate the performance of the setup in practice. To the best of our knowledge, this is the first time a spark gap switch is used to build an electromagnetic (EM) pulse fault injection setup.

show abstract

Design Considerations for EM Pulse Fault Injection

Cited by 9 publications

References 8 publications

(Adversarial) Electromagnetic Disturbance in the Industry

(Adversarial) Electromagnetic Disturbance in the Industry

How Practical Are Fault Injection Attacks, Really?

Design and Evaluation of a Spark Gap Based EM-fault Injection Setup

Contact Info

Product

Resources

About