On error models for RTL security evaluations

Abstract

Evaluating early at design time the level of security achieved with respect to fault-based hardware attacks requires understanding and accurately modeling the faults that can actually occur in a circuit under attack. Attacks with lasers can produce single or multiple-bit errors, while having a local impact in the circuit. This paper discusses several fault or error models that can be considered at design time and summarizes experimental results providing some insights into the consequences of the model chosen for evaluation.

Laser attack benchmark suite

“…Chifre originally only supports bit lips, which do not suice for laser faults. We thus introduced two additional fault models, bit-set and bit-reset to cover all fault models that can occur by laser fault injection [39]. These faults can be user-deined, generated probabilistically or at random.…”

Validation of RTL laser fault injection model with respect to layout information

“…Such disturbances may be propagated and captured to one or more FFs; if this does not occur, then they will not affect the operation of the circuit. In order to add the notion of locality at the Register Transfer Level of abstraction and successfully model laser attacks, the multiple-fault injection approach of [8,9] is based on cone partitioning of the RTL netlist, elaborated from an HDL description.…”

“…In our previous work [8,9] we have proposed a RTL Laser fault injection methodology based on cone partitioning of the elaborated, non-optimized netlist of a hardware description. The implemented tool is targeting to improve the accuracy of early evaluations through the modeling of the locality of laser attacks at RTL.…”

“…In the current article a validation flow is presented, and implemented in order to measure the accuracy of the laser fault model described in [8,9] . In order to obtain the results that are presented, the previously mentioned RTL laser fault model is applied on multiple designs, two of which are presented in the current article.…”

Laser-Induced Fault Effects in Security-Dedicated Circuits

“…The method leads to the creation of a fault space with varying multiplicities for each attack depending on the functional relationship between the cone under attack and all the remaining cones of the circuit [18]. For example in Fig.…”