Evidence of a Larger EM-Induced Fault Model

Abstract

Electromagnetic waves have been recently pointed out as a medium for fault injection within circuits featuring cryptographic modules. Indeed, it has been experimentally demonstrated by A. Dehbaoui et al. [3] that an electromagnetic pulse, produced with a high voltage pulse generator and a probe similar to that used to perform EM analyses, was susceptible to create faults exploitable from a cryptanalysis viewpoint. An analysis of the induced faults [4] revealed that they originated from timing constraint violations. This paper experimentally demonstrates that EM injection, performed with enhanced probes is very local and can produce not only timing faults but also bit-set and bit-reset faults. This result clearly extends the range of the threats associated with EM fault injection.Smart Card Research and Advanced Applications. CARDIS 2014 http://dx.

Impact of Intentional Electromagnetic Interference on Pure Combinational Logic

“…Faults in an Integrated circuit (IC) are created by EMFI either directly when the logic state of some storage elements such as flip-flops is inverted, or when the propagation delay of some combinational paths is so increased that their output is stored while the right value is not arrived [3]. These previous works have focused on the impact of EMFI on a large chain of flip-flops.…”

“…Oumarouayache et al have presented in [2] a guidance for magnetic probe design using simulation. Further experiments by Ordas et al [3] show that different properties of the probes (e.g. number of loop) can lead to a better pulse excitation and resulting impact when testing on real target.…”

A Fully-Digital EM Pulse Detector

“…This is a intuitive explanation of how EMPI induces faults. However, in 2014, [10] has experimentally demonstrated that it is possible to generate faults within a circuit at rest (clocked stopped), using an enhanced EMPI platform. This means that EMPI is able to induce bitsets and bitresets.…”

“…3. One may observe that a HD features mainly DFFs which are, according to the EMP susceptibility model introduced in [10], the most susceptible gates, especially when their clock input toggles. DF F 1 's output (Q 1 ), which is initialized respectively at 1, switches at each rising edge of the clock.…”

“…Within this context, this paper takes advantage of recent results [10], showing that EMPI does mainly induce faults by disrupting the switching process of D Flip-Flop (DFF), in order to define and experimentally validate a new sensor allowing to detect EMP. Because it is fully digital, this sensor consumes little power, occupies small area and is fully compliant with the standard cell design flow followed by Integrated Circuit (IC) designers to design complex SoCs while respecting the time to market constraint.…”