Employing dual-complementary flip-flops to detect EMFI attacks

Deshpande, Chinmay; Yuce, Bilgiday; Nazhandali, Leyla; Schaumont, Patrick

doi:10.1109/asianhost.2017.8354004

Cited by 8 publications

(9 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Three out of the seven discussed sensor designs do not require any tuning. These are the self looped D-flip flop based design [50], the design centered around the Hogge phase detector [53], and the flip flop duplication based approach [52]. Only the Dflip flop-based design advertises to be capable of detecting another fault injection method, namely BBI.…”

Section: Discussionmentioning

confidence: 99%

“…When unlocking of the PLL is detected, an alarm is raised. C. Deshpande et al [52] used a redundancy-based approach where critical flip flops were duplicated to detect incorrect data being latched into the flip flop. J. Breier et al [53] used a Hogge phase detector to detect phase errors in a ring oscillator as an EMFI detector.…”

Section: Surveymentioning

confidence: 99%

“…Requires tuning Also detects Self looped D-flip flop based design [50] × − Hogge phase detector [53] design × − Flip flop duplication based approach [52] × BBI Sensor coil-based approach [46] ✓ EM-measurement probes Time to Digital Conversion (TDC) [47] ✓ Laser shots (See HOST'22 paper [54]) Glitch detector [20] ✓ Voltage and clock glitches PLL-based approach [51] ✓ Clock and voltage glitching…”

Section: Countermeasurementioning

confidence: 99%

See 2 more Smart Citations

(Adversarial) Electromagnetic Disturbance in the Industry

Beckers

Guilley

Maurine

et al. 2023

IEEE Trans. Comput.

View full text Add to dashboard Cite

Faults occur naturally and are responsible for reliability concerns. Faults are also an interesting tool for attackers to extract sensitive information from secure chips. In particular, non-invasive fault attacks have received a fair amount of attention. One easy way to perturb a chip without altering it is the so-called Electromagnetic Fault Injection (EMFI). Such attack has been studied in great depth, and nowadays, it is part and parcel of the state-of-the-art. Indeed, new capabilities have emerged where EM experimental benches are used to cryptanalyze chips. The progress of this "field" is fast, in terms of reproducibility, accuracy, and number of use-cases. However, there is too little awareness about such advances. In this paper, we aim to expose the true harmfulness of EMFI (including reproducibility) to enable reasonable security quotations. We also analyze protections (at hardware/firmware/system levels) in light of their efficiency. We characterize the specificity of EM fault injection compared to other injection means (laser, glitch, probing).

show abstract

Section: Discussionmentioning

confidence: 99%

Section: Surveymentioning

confidence: 99%

Section: Countermeasurementioning

confidence: 99%

See 1 more Smart Citation

(Adversarial) Electromagnetic Disturbance in the Industry

Beckers

Guilley

Maurine

et al. 2023

IEEE Trans. Comput.

View full text Add to dashboard Cite

show abstract

“…In a later work, Timmers et al [54] showed that in an embedded Linux Operating System (OS) the privileges can be escalated from user to system privileges by performing VFI. By performing VFI against AMD's Secure Processor (SP), Buhren et al [11] where able to control the key management and by this, compromise the security of AMD's Secure Encrypted Virtualization (SEV [4,5,32,38,39,48] and Hardware Level Countermeasuress (HLCs) [10,17,19,22,30,31,50,61]. Due to the higher abstraction of ILCs, these protect against a certain Fault Model, whereas the HLCs are generally deployed to protect against a certain type of FI.…”

Section: Related Workmentioning

confidence: 99%

Oops..! I Glitched It Again! How to Multi-Glitch the Glitching-Protections on ARM TrustZone-M

Saß¹,

Mitev²,

Sadeghi³

2023

Preprint

View full text Add to dashboard Cite

Voltage Fault Injection (VFI), also known as power glitching, has proven to be a severe threat to real-world systems. In VFI attacks, the adversary disturbs the power-supply of the target-device forcing the device to illegitimate behavior. Various countermeasures have been proposed to address different types of fault injection attacks at different abstraction layers, either requiring to modify the underlying hardware or software/firmware at the machine instruction level. Moreover, only recently, individual chip manufacturers have started to respond to this threat by integrating countermeasures in their products. Generally, these countermeasures aim at protecting against single fault injection (SFI) attacks, since Multiple Fault Injection (MFI) is believed to be challenging and sometimes even impractical. In this paper, we present µ-Glitch, the first Voltage Fault Injection (VFI) platform which is capable of injecting multiple, coordinated voltage faults into a target device, requiring only a single trigger signal. We provide a novel flow for Multiple Voltage Fault Injection (MVFI) attacks to significantly reduce the search complexity for fault parameters, as the search space increases exponentially with each additional fault injection. We evaluate and showcase the effectiveness and practicality of our attack platform on four real-world chips, featuring TrustZone-M: The first two have interdependent backchecking mechanisms, while the second two have additionally integrated countermeasures against fault injection. Our evaluation revealed that µ-Glitch can successfully inject four consecutive faults within an average time of one day. Finally, we discuss potential countermeasures to mitigate VFI attacks and additionally propose two novel attack scenarios for MVFI.

show abstract

“…This paper [7] proposes a low-cost, fully digital and cycle-accurate mechanism. The proposed sensor circuit consists of an existing main flip-flop and an additional shadow flip-flop that capture complementary values at every clock cycle.…”

Section: Dual Complementary Flip-flop Detectormentioning

confidence: 99%

Detecting Electromagnetic Injection Attack on FPGAs Using In-situ Timing Sensors

Gujar

Nazhandali

2020

J Hardw Syst Secur

View full text Add to dashboard Cite

Nowadays, security is one of the foremost concerns as the confidence in a system is mostly dependent on its ability to protect itself against any attack. The area of Electromagnetic Fault Injection (EMFI) wherein attackers can use electromagnetic (EM) pulses to induce faults has started garnering increasing attention. It became crucial to understand EM attacks I would like to thank my committee members Dr. Leyla Nazhandali, Dr. Patrick Schaumont, and Dr. Lynn Abbott, for their strong support throughout my time at Virginia Tech. I am very grateful to Dr. Nazandali for her constant advice, mentoring and direction which helped me achieve my research goals. I would also like to give my special thanks to my colleagues in the Secure Embedded Systems lab namely Abhishek Bendre, Bilgiday Yuce, Chinmay Deshpande, and Yuan Yao for their prompt help in fixing issues with the setup and answering my questions which helped me to carry forward my research. I would also like to thank Archanaa Krishnan and Daniel Dinu for their supportive and cheerful companionship. I would like to thank the Virginia Tech libraries, Virginia Tech ECE department and the Virginia Tech Graduate School for their contribution in making the masters' thesis a smooth and fulfilling journey for me. I am much thankful to my friends at Virginia Tech for their constant push which motivated to do my best work. Last but not the least, I would like to thank my mom, my dad and my younger brother for their continued confidence in me and my efforts. I have gathered valuable knowledge and essential skills in perseverance and patience during this thesis for which I am eternally obliged to everyone involved. v

show abstract

Employing dual-complementary flip-flops to detect EMFI attacks

Cited by 8 publications

References 9 publications

(Adversarial) Electromagnetic Disturbance in the Industry

(Adversarial) Electromagnetic Disturbance in the Industry

Oops..! I Glitched It Again! How to Multi-Glitch the Glitching-Protections on ARM TrustZone-M

Detecting Electromagnetic Injection Attack on FPGAs Using In-situ Timing Sensors

Contact Info

Product

Resources

About