Experimental Analysis of the Laser-Induced Instruction Skip Fault Model

Abstract

Microcontrollers storing valuable data or using security functions are vulnerable to fault injection attacks. Among the various types of faults, instruction skips induced at runtime proved to be effective against identification routines or encryption algorithms. Several research works assessed a fault model that consists in a single instruction skip, i.e. the ability to prevent one chosen instruction in a program from being executed. This assessment is used to design countermeasures able to withstand a single instruction skip. We question this fault model on experimental basis and report the possibility to induce with a laser an arbitrary number of instruction skips. This ability to erase entire sections of a firmware has strong implications regarding the design of countermeasures.

Experimental Analysis of the Electromagnetic Instruction Skip Fault Model

“…The state-of-the-art in laser-induced instruction skip reports that the number of successive instructions that could be skipped was not limited in the same 8-bit microcontroller as the one studied in this work [21]. Moreover, the injection can be syncronized with the program execution and the duration of the laser pulse is linearly correlated with the number of consecutive instructions which are skipped.…”

“…Figure 1 gives a front view of the test chip with its Flash, RAM and EEPROM memories highlighted in red. The laser sensitive area that makes it possible to induce an instruction skip is highlighted by a small deep blue star (slightly outside the Flash memory at its left), it is in the order of a few micrometers [21]. The EM sensitive area, which is convenient for inducing instruction skips, is larger (see experimental results in section IV), it is in the order of a hundred of micrometers.…”

“…EMFI has a local effect ( [7], [24]) that may be classified in between the strongly local effect of laser FI [21] and the global effect of other FI means (such as clock and power glitches). As a result, the position of the injection probe w.r.t.…”

“…the target has a significant effect on the FI process: a fault may be injected or not, different FMs may be obtained ( [7], [11], [12]). Our research objective was to induce instruction skips similar to that described in [21] for laser FI. This implied to test a large amount of settings: injection probe location, synchronization with the test code, and voltage pulse parameters.…”

“…This fault model shares similarities with laser-induced instruction skips in terms of accuracy and repeatability under the same synchronization requirements. However, the number of consecutive instructions which can be skipped is limited with the EM injection technique, whereas an arbitrary number of instruction can be blinded with laser injection [21]. This difference might be understood as a difference in the nature of the stress induced by laser and EM injection techniques.…”