Efficiency of a glitch detector against electromagnetic fault injection

Abstract

The use of electromagnetic glitches has recently emerged as an effective fault injection technique for the purpose of conducting physical attacks against integrated circuits. First research works have shown that electromagnetic faults are induced by timing constraint violations and that they are also located in the vicinity of the injection probe. This paper reports the study of the efficiency of a glitch detector against EM injection. This detector was originally designed to detect any attempt of inducing timing violations by means of clock or power glitches. Because electromagnetic disturbances are more local than global, the use of a single detector proved to be inefficient. Our subsequent investigation of the use of several detectors to obtain a full fault detection coverage is reported, it also provides further insights into the properties of electromagnetic injection and into the key role played by the injection probe.

Evidence of a Larger EM-Induced Fault Model

“…Thus the authors of [3] showed on experimental grounds that EM injection, performed with raw EM injectors, produces timing faults (induced by setup time constraint violations). This observation should explain why a glitch detector was tested and find partially e cient in detecting EM injection in [13]. The setup time constraint is related to the amount of time spent by the circuit to process a data.…”

“…This paper concludes that EM injection produces timing faults and more precisely setup time constraint violations as described in section 3. As a result of this observation, a delay-based glitch detector was evaluated against EM injection in [13] and demonstrated partially e cient.…”

The Impact of Pulsed Electromagnetic Fault Injection on True Random Number Generators

“…7 it is clear that unless a DC-TRNG running with a frequency lower than 170kHz, pulsed EMFI does not constitute a major threat (as a reminder during the experiment part the DC-TRNG was running at 4.5MHz). However, there is room to increase the repetition rate of EMFI platforms and adding EMFI detectors [12], [13], [14] to protect TRNGs should not be viewed as a luxury solution in the future. bias for stuck at 00 bias for stuck at 11 bias for stuck at 1 bias for stuck at 0 bias(%) F requency(kHz) zoom on range 140 to 195 kHz Fig.…”

Electromagnetic analysis and fault injection onto secure circuits

“…Obviously, the critical path of the detector chain must be properly set between the longest critical path of the circuit and the clock period, in order to avoid non detection and false positives. The placement of several detectors has been evaluated in [13]: up to 5 detectors were added to the implementation, with a negligible overhead. [14].…”