An Automated Formal Process for Detecting Fault Injection Vulnerabilities in Binaries and Case Study on PRESENT

Given-Wilson, Thomas; Jafri, Nisrine; Lanet, Jean‐Louis; Legay, Axel

doi:10.1109/trustcom/bigdatase/icess.2017.250

Cited by 16 publications

(36 citation statements)

References 30 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This section discusses the process used to detect fault injection vulnerabilities. In the earlier work, a simpler version of this process was presented, and here, a pre‐analysis step is added that improves efficiency.…”

Section: Processmentioning

confidence: 99%

“…However, most aspects of the process do not rely upon this choice, and future work is to be able to start directly from the binary. For further discussion, refer to the earlier work …”

Section: Processmentioning

confidence: 99%

“…Thus, recent work has approached the problem of fault injection by limiting the scope of attacks or by limiting the kinds of vulnerabilities analyzed, often requiring specialized equipment. This paper proposes an extension of the automated formal process introduced in the earlier work for the detection of fault injection vulnerabilities in binaries. This extension overcomes limitations in the scalability of the pure model‐based general process.…”

Section: Introductionmentioning

confidence: 99%

“…The strengths of this approach include the following. By operating directly upon the binary, fault injection vulnerabilities that cannot be detected in source languages or intermediate representations can be detected . Formal methods, model checking here, ensure the rigor of the analysis and so ensure that fault injection vulnerabilities that are detected are real and not false positives.…”

Section: Introductionmentioning

confidence: 99%

“…The core encryption algorithm is the same for both 80 and 128 bit keys. The version of PRESENT analyzed here is the canonical version in C for 32 bit architectures (size optimized, 80 bit key) as used in the earlier work …”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

An automated and scalable formal process for detecting fault injection vulnerabilities in binaries

Given-Wilson

Heuser²,

Jafri

et al. 2018

Concurrency and Computation

Self Cite

View full text Add to dashboard Cite

Fault injection has increasingly been used both to attack software applications, and to test system robustness. Detecting fault injection vulnerabilities has been approached with a variety of different but limited methods. This paper proposes an extension of a recently published general model checking based process to detect fault injection vulnerabilities in binaries. This new extension makes the general process scalable to real-world implementions which is demonstrated by detecting vulnerabilities in different cryptographic implementations.

show abstract

Section: Processmentioning

confidence: 99%

“…However, most aspects of the process do not rely upon this choice, and future work is to be able to start directly from the binary. For further discussion, refer to the earlier work …”

Section: Processmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

An automated and scalable formal process for detecting fault injection vulnerabilities in binaries

Given-Wilson

Heuser²,

Jafri

et al. 2018

Concurrency and Computation

Self Cite

View full text Add to dashboard Cite

show abstract

The State of Fault Injection Vulnerability Detection

Given-Wilson

Jafri

Legay

2018

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Fault injection is a well known method to test the robustness and security vulnerabilities of software. Fault injections can be explored by simulations (cheap, but not validated) and hardware experiments (true, but very expensive). Recent simulation works have started to apply formal methods to the detection, analysis, and prevention of fault injection attacks to address verifiability. However, these approaches are ad-hoc and extremely limited in architecture, fault model, and breadth of application. Further, there is very limited connection between simulation results and hardware experiments. Recent work has started to consider broad spectrum simulation approaches that can cover many fault models and relatively large programs. Similarly the connection between these broad spectrum simulations and hardware experiments is being validated to bridge the gap between the two approaches. This presentation highlights the latest developments in applying formal methods to fault injection vulnerability detection, and validating software and hardware results with one another.

show abstract

Adversarial Reachability for Program-level Security Analysis

Ducousso

Bardin

Potet

2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Many program analysis tools and techniques have been developed to assess program vulnerability. Yet, they are based on the standard concept of reachability and represent an attacker able to craft smart legitimate input, while in practice attackers can be much more powerful, using for instance micro-architectural exploits or fault injection methods. We introduce adversarial reachability, a framework allowing to reason about such advanced attackers and check whether a system is vulnerable or immune to a particular attacker. As equipping the attacker with new capacities significantly increases the state space of the program under analysis, we present a new symbolic exploration algorithm, namely adversarial symbolic execution, injecting faults in a forkless manner to prevent path explosion, together with optimizations dedicated to reduce the number of injections to consider while keeping the same attacker power. Experiments on representative benchmarks from fault injection show that our method significantly reduces the number of adversarial paths to explore, allowing to scale up to 10 faults where prior work timeout for 3 faults. In addition, we analyze the well-tested WooKey bootloader, and demonstrate the ability of our analysis to find attacks and evaluate countermeasures in real-life security scenarios. We were especially able to find an attack not mentioned in a previous patch.

show abstract

An Automated Formal Process for Detecting Fault Injection Vulnerabilities in Binaries and Case Study on PRESENT

Cited by 16 publications

References 30 publications

An automated and scalable formal process for detecting fault injection vulnerabilities in binaries

An automated and scalable formal process for detecting fault injection vulnerabilities in binaries

The State of Fault Injection Vulnerability Detection

Adversarial Reachability for Program-level Security Analysis

Contact Info

Product

Resources

About