Electromagnetic Fault Injection : How Faults Occur

Dumont, Mathieu; Lisart, Mathieu; Maurine, Philippe

doi:10.1109/fdtc.2019.00010

Cited by 32 publications

(15 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The authors of [7] and [13] highlighted the similarities between EM induced faults in an IC and faults that were obtained with the violation of timing constraints. A model of the glitch induced by an EM pulse on a power-ground network was later proposed in [26]. The authors of [25] suggested that glitching the set and reset circuitry corrupts the operation of D-flip-flop memory cells, thus explaining the specificity of the timing of EM injections.…”

Section: B Discussion Of the Em-induced Fault Injection Mechanismmentioning

confidence: 99%

Experimental Analysis of the Electromagnetic Instruction Skip Fault Model

Menu¹,

Dutertre²,

Potin³

et al. 2020

2020 15th Design &Amp; Technology of Integrated Systems in Nanoscale Era (DTIS)

View full text Add to dashboard Cite

Microcontrollers storing valuable data or using security functions are vulnerable to fault injection attacks. Among the various types of faults, instruction skips induced at runtime proved to be effective against identification routines or encryption algorithms. Until recently, most research works assessed a fault model that consists in a single instruction skip, i.e. the ability to prevent one chosen instruction in a program from being executed. We question this fault model for EM fault injection on experimental basis and report the possibility to induce several consecutive instructions skips. Index Terms-EM fault injection, fault model This research has been partially supported by the European Commission under H2020 SPARTA (Grant Agreement 830892).

show abstract

Section: B Discussion Of the Em-induced Fault Injection Mechanismmentioning

confidence: 99%

Experimental Analysis of the Electromagnetic Instruction Skip Fault Model

Menu¹,

Dutertre²,

Potin³

et al. 2020

2020 15th Design &Amp; Technology of Integrated Systems in Nanoscale Era (DTIS)

View full text Add to dashboard Cite

show abstract

“…Characterizing ISA faults is an interesting approach when you have no access to the hardware IP. Another approach [4,9] is to focus on characterizing faults at the level of transistors and logic gates.…”

Section: Related Workmentioning

confidence: 99%

Electromagnetic fault injection against a complex CPU, toward new micro-architectural fault models

et al. 2021

View full text Add to dashboard Cite

The last years have seen the emergence of fault attacks targeting modern central processing units (CPUs). These attacks are analyzed at a very high abstraction level and, due to the modern CPUs complexity, the underlying fault effect is usually unknown. Recently, a few articles have focused on characterizing faults on modern CPUs.In this article, we focus on the electromagnetic fault injection (EMFI) characterization on a bare-metal implementation. With this approach, we discover and understand new effects on micro-architectural subsystems. We target the BCM2837 where we successfully demonstrate persistent faults on L1 instruction cache, L1 data cache and L2 cache. We also show that faults can corrupt the memory management unit (MMU). To validate our fault model, we realize a persistent fault analysis to retrieve an AES key.

show abstract

“…How these induced voltages and currents propagate through a particular IC requires extensive testing or detailed EM-simulations. This aspect has been recently investigated by Dumont et al [5], which model the interactions between EM probes, EM pulses and ICs to gain understanding on the occurrence of EM faults.…”

Section: Challengementioning

confidence: 99%

“…In addition to academic literature, there exist several commercial solutions available for EM-FI such as the NewAE's ChipSHOUTER 4 , Riscure's EM-FI Transient Probe 5 or Langer EMV's ICI Set 6 . For most of these setups, the circuitry used for pulse generation is not public information.…”

Section: Introductionmentioning

confidence: 99%

Design Considerations for EM Pulse Fault Injection

Beckers

Kinugawa

Hayashi

et al. 2020

Smart Card Research and Advanced Applications

View full text Add to dashboard Cite

Electromagnetic-fault injection (EM-FI) setups are appealing since they can be made at a low cost, achieve relatively high spatial resolutions, and avoid the need of tampering with the PCB or packaging of the target. In this paper we first sketch the importance of understanding the pulse characteristics of a pulse injection setup in order to successfully mount an attack. We then look into the different components that make up an EM-pulse setup and demonstrate their impact on the pulse shape. The different components are then assembled to form an EM-pulse injection setup. The effectiveness of the setup and how different design decisions impact the outcome of a fault injection campaign are demonstrated on a 32-bit ARM microcontroller.

show abstract

Electromagnetic Fault Injection : How Faults Occur

Cited by 32 publications

References 13 publications

Experimental Analysis of the Electromagnetic Instruction Skip Fault Model

Experimental Analysis of the Electromagnetic Instruction Skip Fault Model

Electromagnetic fault injection against a complex CPU, toward new micro-architectural fault models

Design Considerations for EM Pulse Fault Injection

Contact Info

Product

Resources

About