Characterization of EM faults on ATmega328p

Beckers, Arthur; Balasch, Josep; Gierlichs, Benedikt; Verbauwhede, Ingrid; Osuka, Saki; Kinugawa, Masahiro; Fujimoto, Daisuke; Hayashi, Yu-ichi

doi:10.23919/emcsapporo/apemc44270.2019.9320849

Cited by 11 publications

(8 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…-AVR: [47] and [44] target the SRAM while [71] aims at the flash memory. -ARM (standalone): [14] targets the flash memory and [44] corrupts the registers.…”

Section: Current State-of-the-art Techniques and Their Practicalitymentioning

confidence: 99%

How Practical Are Fault Injection Attacks, Really?

Breier

Hou

2022

IEEE Access

View full text Add to dashboard Cite

Fault injection attacks (FIA) are a class of active physical attacks, mostly used for malicious purposes such as extraction of cryptographic keys, privilege escalation, attacks on neural network implementations. There are many techniques that can be used to cause the faults in integrated circuits, many of them coming from the area of failure analysis. In this paper we tackle the topic of practicality of FIA. We analyze the most commonly used techniques that can be found in the literature, such as voltage/clock glitching, electromagnetic pulses, lasers, and Rowhammer attacks. To summarize, FIA can be mounted on most commonly used architectures from ARM, Intel, AMD, by utilizing injection devices that are often below the thousand dollar mark. Therefore, we believe these attacks can be considered practical in many scenarios, especially when the attacker can physically access the target device.INDEX TERMS Hardware security, fault injection attacks, fault analysis, cryptography.

show abstract

“…-AVR: [47] and [44] target the SRAM while [71] aims at the flash memory. -ARM (standalone): [14] targets the flash memory and [44] corrupts the registers.…”

Section: Current State-of-the-art Techniques and Their Practicalitymentioning

confidence: 99%

How Practical Are Fault Injection Attacks, Really?

Breier

Hou

2022

IEEE Access

View full text Add to dashboard Cite

show abstract

“…The most common techniques used for Fault Injection Attacks (FIA) are: Clock or Voltage tampering [1], [2], [18], Electromagnetic Fault Injection (EMFI) [3], [11], [13], [14], Optical Fault Injection [6], [17], [19]. The attacks can be classified into invasive, semi-invasive, and non-invasive attacks.…”

Section: Introductionmentioning

confidence: 99%

“…LFI is reported of being able to cause faults on data stored in volatile memories (Static Random Access Memory (SRAM) or registers) [10], [15], [16], with the different underlying technologies and data while moving from one to another component without affecting the data stored in non-volatile source memories [3], [11], [22]. Specifically, LFI can be used to target and modify instructions, causing them to be corrupted, skipped, etc.…”

Section: Introductionmentioning

confidence: 99%

Laser Fault Injection in a 32-bit Microcontroller: from the Flash Interface to the Execution Pipeline

Khuat

Danger

Dutertre

2021

2021 Workshop on Fault Detection and Tolerance in Cryptography (FDTC)

View full text Add to dashboard Cite

In this paper, we report on a method for obtaining faults using Laser Fault Injection (LFI) in a 32-bit Microcontroller (MCU) from the Flash interface to the execution pipeline via the AHB bus. Different fault behaviors were obtained at six positions along the instruction channel. Instruction(s) were observed to be faulted with a reproducibility of 100% at each position. By collecting the faults on all the positions together and analyzing their behaviors, the faults were identified and characterized. The faults on the Flash interface buffer are different depending on the cache operation modes. When the cache is disabled, the fault is related to a block of 32 bits, whereas when the cache is enabled, the fault is related to a block of 64 bits. Two fault models, namely, replay and skip of instructions block were obtained depending on the injection position. The fault happening at the AHB bus is with a block of two instructions in both cache operation modes. Depending on the injection position, two fault models of replay and skip of two instructions were also observed. The faults on the core pipeline are related to a single instruction. The fault behavior is such that both the fetch and execution stages were faulted. The skip of a single instruction was obtained by faulting either the fetch or the execution stage of the core pipeline. By increasing the Pulse Width (PW), tens to more than one hundred of instructions were faulted at each position. The impacts of LFI parameters such as the PW and the power on the faults were studied. In addition, we compared skip fault models achieved at different positions. Our results illustrate the spatial and temporal accuracy of the LFI, thus pointing out the vulnerable positions and unveiling information of the device architecture.

show abstract

“…Optical fault injection is the method in which the optical source, specifically the laser source, is used to induce ionization in electronic circuit devices hence causing the targets to behave differently. The disadvantages of this method are: (1) the cost of equipment is relatively high (2) and well-trained staffs are needed to operate the laser. However, the laser has the advantage that it has a very high temporal and spatial accuracy.…”

Section: Introductionmentioning

confidence: 99%

“…LFI is reported of being able to cause faults on data stored in memories such as volatile type [12], or data being transferred on the communication bus without affecting the data stored in the source memories [2]. Specifically, LFI can target and modify instructions being read from memories to Processor Core (PC), causing instruction corruption, instruction skip, etc.…”

Section: Introductionmentioning

confidence: 99%

Analysis of a Laser-induced Instructions Replay Fault Model in a 32-bit Microcontroller

Khuat

Dutertre

Danger

2021

2021 24th Euromicro Conference on Digital System Design (DSD)

View full text Add to dashboard Cite

In this paper, we present a method to obtain a new Laser Fault Injection (LFI)-induced fault model: replay of instructions on a 32-bit Microcontroller (MCU). This method allows a potential adversary to replay a block of two or four instructions with a fault rate up to 100%. These faults are induced by laser pulses and cause the instructions updating process of a Flash buffer to fail. As a result, the new instructions failing to be stored in the Flash buffer, the previous ones are replayed. We deeply studied the properties of this replay fault model by many experiments of laser fault injections. We have notably shown that the sensitivity window is proportional to the laser Pulse Width (PW), and that up to 20 instructions in a row were tested to be overwritten due to replaying five times the block of four instructions. The effects of the laser power and cache status (enabled or disabled) are also presented. Finally, we proposed and assessed a simple method to detect the LFI-induced replay faults using a hardware counter with different increments. Our results extend the ability of LFI on MCU, illustrating the accuracy and reproducibility of LFI.

show abstract

Characterization of EM faults on ATmega328p

Cited by 11 publications

References 10 publications

How Practical Are Fault Injection Attacks, Really?

How Practical Are Fault Injection Attacks, Really?

Laser Fault Injection in a 32-bit Microcontroller: from the Flash Interface to the Execution Pipeline

Analysis of a Laser-induced Instructions Replay Fault Model in a 32-bit Microcontroller

Contact Info

Product

Resources

About