Optimizing Electromagnetic Fault Injection with Genetic Algorithms

Abstract

Article 25fa pilot End User AgreementThis publication is distributed under the terms of Article 25fa of the Dutch Copyright Act (Auteurswet) with explicit consent by the author. Dutch law entitles the maker of a short scientific work funded either wholly or partially by Dutch public funds to make that work publicly available for no consideration following a reasonable period of time after the work was first published, provided that clear reference is made to the source of the first publication of the work.This publication is distributed under The Association of Universities in the Netherlands (VSNU) 'Article 25fa implementation' pilot project. In this pilot research outputs of researchers employed by Dutch Universities that comply with the legal requirements of Article 25fa of the Dutch Copyright Act are distributed online and free of cost or other barriers in institutional repositories. Research outputs are distributed six months after their first online publication in the original published version and with proper attribution to the source of the original publication.You are permitted to download and use the publication for personal purposes. All rights remain with the author(s) and/or copyrights owner(s) of this work. Any use of the publication other than authorised under this licence or copyright law is prohibited.If you believe that digital publication of certain material infringes any of your rights or (privacy) interests, please let the Library know, stating your reasons. In case of a legitimate complaint, the Library will make the material inaccessible and/or remove it from the website.

Efficient Attack-Surface Exploration for Electromagnetic Fault Injection

“…They address the problem of identifying the subspace of the duration and intensity values of pulses that could produce an actual fault with a two-step process, that is, trying to optimize the parameters separately. Maldini et al [14] bring this work to EMFI through an evolutionary algorithm that tries to find the optimal geometric and pulse intensity values that maximize fault occurrence ratio while keeping some of the configuration fixed (pulse duration). Madau et al [13] offer an alternative methodology to locate the best areas to obtain unexpected behaviors on the surface of the chip; Each surface point, starting from a predefined grid, is rated using a susceptibility criterion that requires measuring electromagnetic emissions.…”

DELFASE: A Deep Learning Method for Fault Space Exploration

“…Both SEInjector and DriveFI rely on domain knowledge about the SUT to prune the fault space. Maldini et al [8] propose an evolutionary algorithm for optimizing the search in the fault space and use the algorithm to attack a cryptography algorithm. The proposed algorithm relies less on prior knowledge and is more suitable for blackbox testing scenarios.…”

“…This model represents the knowledge learned automatically through interaction with the SUT, and helps us locate more critical faults with less effort. Note that, effective exploration of the fault space has also been studied in the past using other techniques such as those that are deterministic [5], [6] or model-based [7], as well as those that are based on evolutionary optimization [8] or reinforcement learning [9].…”

An End-to-End Approach for Multi-Fault Attack Vulnerability Assessment

“…On the other hand, Carpi et al [11], Wu et al [12] and Maldini et al [13] propose fault injection settings search strategies respectively for Voltage Fault Injection (VFI), LFI and ElectroMagnetic Fault Injection (EMFI). Using Genetic Algorithms or Deep Learning, they find the most efficient fault injection settings, such as injection delays and other parameters specific to the fault injection technique, to speed up the fault exploitation.…”