PaperlayerView exact revision on arXiv

Source-linked AI summary

Electromagnetic fault injection: towards a fault model on a 32-bit microcontroller

Nicolas Moro, Amine Dehbaoui, Karine Heydemann, Bruno Robisson, Emmanuelle Encrenaz

arXiv:1402.6421v1cs.CR

TL;DR

Electromagnetic fault injection on microcontrollers lacks a precise account of its effects and an associated fault model. The paper studies these effects experimentally and through simulation, finding instruction and Flash-loaded data modifications that support a more accurate assembly-level model.

  • Problem

    The paper addresses the lack of a precise study of electromagnetic glitch effects on microcontrollers and an associated fault model.

  • Method

    The authors combine electromagnetic fault-injection experiments with simulation to characterize program-flow and data-flow faults and derive a register-transfer level model.

  • Results

    The experiments confirm that an attacker can change an instruction or the value of data loaded from Flash, with some instructions and registers more vulnerable than others.

  • Takeaways & Limitations

    The observations support more specific and accurate countermeasures for the studied architecture.

Abstract

from arXiv · show

Injection of transient faults as a way to attack cryptographic implementations has been largely studied in the last decade. Several attacks that use electromagnetic fault injection against hardware or software architectures have already been presented. On microcontrollers, electromagnetic fault injection has mostly been seen as a way to skip assembly instructions or subroutine calls. However, to the best of our knowledge, no precise study about the impact of an electromagnetic glitch fault injection on a microcontroller has been proposed yet. The aim of this paper is twofold: providing a more in-depth study of the effects of electromagnetic glitch fault injection on a state-of-the-art microcontroller and building an associated register-transfer level fault model.

I. INTRODUCTION

The paper motivates precise electromagnetic fault control by showing that fault attacks depend on accurate timing and bit targeting. It studies electromagnetic pulses on a modern microcontroller and aims to derive a precise fault model.

  • Motivation: Electromagnetic glitches are one of several practical means for inducing faults into circuit computations.Other methods mentioned include laser shots, overclocking, underpowering, and temperature increase.
  • Motivation: Fault attacks rely on attacker-defined fault models, so mistiming or affecting the wrong bits can make the attack fail.Common models include instruction skips, single-bit faults, and single-word faults.
  • Contribution: The paper studies electromagnetic pulses on an up-to-date microcontroller and examines their local effects.The study targets faults induced in computations rather than only instruction or subroutine skipping.
  • Contribution: The work aims to define a precise fault model and explain the faults an electromagnetic glitch can induce in an embedded program.Its organization covers the injection setup, parameter influence, program and data flow effects, and a register-transfer level model.
  • Approach: The characterization approach matches experimental microcontroller outputs with simulation data to interpret injected faults.The approach is introduced alongside the experimental setup and developed as the basis for fault characterization.

1) Electromagnetic fault injection bench:

The injection bench combines computer-controlled pulse generation, a motorized positioning stage, and a magnetic antenna to disturb a localized region of a 32-bit Cortex-M3 microcontroller. The target operates at 56 MHz and includes basic fault-related security mechanisms but no electromagnetic shield.

  • 1) Electromagnetic fault injection bench:: The bench contains a control computer, target device, motorized stage, pulse generator, and magnetic antenna.The computer controls the pulse generator through RS-232 and the target board through USB.
  • 1) Electromagnetic fault injection bench:: The pulse generator drives a magnetic coil with pulses ranging from −200 V to 200 V and 10 ns to 200 ns in width.The generator’s rise and fall transition time is 2 ns.
  • 1) Electromagnetic fault injection bench:: A 1 mm-diameter magnetic antenna and high-accuracy X Y Z stage enable spatially localized disturbance of the target device.The stage varies the injection probe position during experiments.
  • 1) Electromagnetic fault injection bench:: The target is a 32-bit CMOS 130 nm microcontroller based on ARM Cortex-M3, operating at 56 MHz without cache memory.Its instruction set includes both 16-bit and 32-bit Thumb2 instructions.
  • 1) Electromagnetic fault injection bench:: The target has basic protections against clock and voltage glitches but no protective shield against reverse engineering or electromagnetic injection.The authors therefore do not treat it as a highly secure microcontroller.

2) Target:

The experiment resets the microcontroller, executes target code, injects a pulse during a trigger window, interrupts execution, and harvests internal state through SWD. This setup targets individual clock cycles but cannot directly access the instruction register.

  • 1) Microcontroller’s internal state observation:: The measurement process resets the microcontroller, executes target code, sends a pulse, interrupts execution, and harvests internal data.The sequence is designed to recover state after the transient injection.
  • 1) Microcontroller’s internal state observation:: A trigger signal and clock observation let the experiment target the executed program at the scale of a single instruction and clock cycle.Pulse injection time is referenced to the trigger window.
  • 1) Microcontroller’s internal state observation:: Faults can divert execution through an unconditional jump or an exception loop, preventing the program from reaching its normal breakpoint.The breakpoint is set after the target code and after the trigger window.
  • 1) Microcontroller’s internal state observation:: SWD retrieves registers r0–r12, r13, r14, r15, xPSR, selected memory variables, and the experiment’s clock-cycle count.xPSR provides processor flags and information about triggered exceptions.
  • 1) Microcontroller’s internal state observation:: The instruction register cannot be accessed directly, so identifying the executed instruction may require exhaustive instruction simulation.This constraint applies when working at the scale of a single instruction.

2) Fault model simulation:

The paper characterizes faults by comparing experimental outputs with simulations that replace instructions and inspect resulting states. This distinguishes program-flow faults from data-flow faults when an output cannot be explained by an instruction replacement.

  • 2) Fault model simulation:: The simulation approach compares faulty experimental outputs with fault-model simulation outputs and internal data.Matching outputs is used to validate the interpretation of injected effects.
  • 2) Fault model simulation:: An instruction replacement explains a measurement when the watchpoint states [r0-r12] and xPSR match between experiment and simulation.This binary relation defines the paper’s operational matching criterion.
  • 2) Fault model simulation:: Program-flow faults replace an instruction, whereas data-flow faults modify data without modifying the instruction.Both classes can produce similar visible outputs, making their distinction difficult.
  • 2) Fault model simulation:: A faulty output that cannot be explained by an instruction replacement is classified as a data-flow fault.The classification relies on the limited set of data a single assembly instruction can output.
  • 2) Fault model simulation:: Exhaustive testing is practical for 16-bit Thumb2 instructions, while prefixes and sparsity reduce the search complexity for 32-bit instructions.The simulator replaces the target instruction on the fly using the same binary as the injection experiment.

III. EXPERIMENTAL STUDY OF THE INJECTION PARAMETERS

The experiments examine metastability and controllable injection parameters, showing that a fixed electromagnetic-glitch configuration can produce varying load outputs and that timing is studied systematically.

  • B. Study of the injection parameters: The study varies pulse voltage, width, injection time, and probe position as experimental parameters that may affect final outputs.Except for voltage experiments, the pulse voltage was fixed at 190 V; pulse width was 10 ns at 56 MHz.
  • B. Study of the injection parameters: The injection-time experiment evaluates how pulse timing influences an array sum whose expected result is 0xFF.The experiment is presented as Figure 4.

1) Position of the injection probe over the package’s surface:

Varying probe position and injection time at a single Flash load instruction produced distinct outcomes, including register faults, crashes, exceptions, and normal execution.

  • 1) Position of the injection probe over the package’s surface:: The probe-position and timing experiment targeted a single load of 0x12345678 from Flash into R8.The experiment varied X Y coordinates and injection time over a 20 ns interval.
  • 1) Position of the injection probe over the package’s surface:: Four output classes were observed: no fault, microcontroller crash, Usage Fault exception, and a fault on R8.A few R0 faults also occurred, but R8 and R0 were never faulted together.
  • 1) Position of the injection probe over the package’s surface:: The array-sum test program iterated over eight powers of two and normally stored 0xFF as its result.Its execution time was approximately 3.5 µs, with injections stepped by 200 ps.
  • 1) Position of the injection probe over the package’s surface:: The test program comprised an addition loop with loads, an addition, a store, index increment, comparison, and branch instructions.These instructions provided multiple points at which injection effects could be observed.
  • 1) Position of the injection probe over the package’s surface:: The array-sum experiment observed hardware exceptions, faulty output values, and normal behavior without faults.Every faulty output corresponded to omitting one power of two from the sum.

3) Pulse characteristics:

Pulse width and voltage influence electromagnetic-fault outputs: longer pulses alter induced glitches, while higher voltage increases the Hamming weight of faulty Flash loads.

  • 3) Pulse characteristics:: Pulse width influences outputs because the induced electromotive force depends on magnetic-flux variation and therefore current variation in the injection solenoid.The experiments also observed effects from sending longer pulses.
  • 3) Pulse characteristics:: The pulse-voltage experiment used a single LDR instruction configured to fault a value loaded from Flash memory.Other experimental parameters were fixed to isolate voltage’s influence.
  • 3) Pulse characteristics:: Increasing pulse voltage increases the Hamming weight of the faulty value loaded from Flash.Figure 5 reports Hamming distance relative to the expected value 0x12345678.
  • 3) Pulse characteristics:: Similar voltage-related fault trends were obtained across different probe positions and injection times.The reported pattern concerns the faulty output with the highest occurrence rate.
  • 3) Pulse characteristics:: Similar set-to-1 faults were not obtained for data transfers from SRAM, suggesting the observed behavior was specific to Flash loads in these experiments.The paper reports that only Flash-load instructions appeared to produce this fault pattern.

4) Type of the executed instructions:

The study finds faults across instruction classes, then uses controlled experiments and exhaustive simulation to characterize whether observed effects arise on the control or data flow.

  • 4) Type of the executed instructions:: Faults were injected into branch, ALU, and load-store instructions, with Flash-memory loads significantly easier to fault.The architecture uses separate instruction and data buses, motivating separate bus-focused analysis.
  • IV. EXPERIMENTS ON THE DATA AND INSTRUCTION BUS: The data- and instruction-bus experiments used controlled test applications to reduce side effects when analyzing many assembly instructions.The program-flow analysis used a sequence of NOP instructions because NOPs have no effect.
  • IV. EXPERIMENTS ON THE DATA AND INSTRUCTION BUS: The initial register and execution state was recorded at the beginning of the experiment.These initial values are summarized in Table IV.
  • A. Faults on the program flow: Program-flow faults were studied as instruction replacements, but 16-bit and 32-bit replacement combinations make exhaustive search impractical.A 32-bit fetch may correspond to one 32-bit instruction, two 16-bit instructions, or other replacement scenarios.
  • A. Faults on the program flow: A NOP sled was targeted to demonstrate that electromagnetic injection can affect program flow.Different probe positions and injection times produced different results.

1) Hardware exceptions:

The injections produced a limited set of observable faults, including Usage Fault exceptions, register faults, instruction replacements, and data-flow faults. The experiments did not provide a complete catalogue, but every observed faulty result had an instruction-replacement explanation or was associated with data-flow effects.

  • Hardware exceptions:: Only No coprocessor and Undefined instruction Usage Fault exceptions were observed, both caused by invalid opcodes.The authors suggest faults during instruction fetch or decode as a possible explanation.
  • Hardware exceptions:: Instruction-replacement simulation explained the observed r0 fault as STR r0,[r0,#0] and also accounted for another observed value, 0x100.The replacement stores r0 at the address pointed to by r0 without an offset.
  • Hardware exceptions:: Faults affected r7, r15, and values at addresses pointed to by r0, while no faults were observed on r1-r6 or r8-r14.Faults on r7 and r15 appeared more often informally than faults on the memory address pointed to by r0.
  • Hardware exceptions:: The experiments were not intended to enumerate all possible faults, and occurrence percentages were considered irrelevant because injection parameters had many configurations.The authors conclude that the observed faulty results support an initial set-at-1 fault model.
  • Hardware exceptions:: For a targeted LDR, faulty outputs such as 0xFFF45678 could not be explained by any single 16-bit or 32-bit instruction replacement.The authors therefore considered that two 16-bit instructions may have been affected.

C. Analysis at a lower abstraction level

Bus-transfer analysis links electromagnetic injection to timing faults in the microcontroller’s separate instruction and data buses. Flash transfers are the observed target, with instruction fetches producing complex replacements and data transfers exposing precharge-related behavior.

  • C. Analysis at a lower abstraction level: Faults were observed only on data and instruction transfers from Flash, whose slower response time makes its bus transfers more exposed than SRAM transfers.Instruction fetches always transfer from instruction memory, while load decoding transfers from data memory.
  • C. Analysis at a lower abstraction level: The microcontroller uses separate 32-bit instruction and data buses organized with AMBA AHB-Lite, enabling faults to be analyzed through bus transfers.The analysis treats electromagnetic glitches as timing faults in this architecture.
  • C. Analysis at a lower abstraction level: Each memory fetch requires at least two clock cycles, with instruction addresses placed on HADDRI and fetched words returned on HRDATAI.A 32-bit fetch carries two 16-bit NOP instructions during the fetch stage.
  • C. Analysis at a lower abstraction level: Instruction-fetch faults can replace a NOP with STR r0,[r0,#0], and their model appears more complex than the set-at-1 model for data fetches.The observed relationship between injection stress and fetched-word Hamming weight differs between instruction and data fetches.
  • C. Analysis at a lower abstraction level: The HRDATAI precharge value is implementation-specific and could not be inferred beyond a possible value of 0 or a more complex strategy.The bus intellectual property does not specify precharge values, which are chosen by the circuit manufacturer.
  • C. Analysis at a lower abstraction level: For Flash transfers, the critical path appears to be the HRDATAI bus transfer, allowing electromagnetic injection to target instruction fetches.The authors characterize this possibility as potentially harmful because it can affect any instruction fetch from Flash.

B. Data fetches

Data-fetch injections can be localized to the data bus, where the critical HRDATA transfer is affected. The resulting faults show metastability but follow a set-at-1 trend that moves loaded values toward the bus precharge value.

  • B. Data fetches: Electromagnetic injection can be positioned to affect the data bus without reaching the instruction bus during a data fetch.The critical path for this scenario appears to be the HRDATA bus transfer.
  • B. Data fetches: Metastability appears during data-fetch injection, but the overall behavior follows a set-at-1 fault model.The trend depends on the microcontroller’s implementation-specific bus precharge strategy.
  • B. Data fetches: The data-fetch model lets an attacker bring the loaded value closer to the bus precharge value.This trend provides a more precise fault model for data fetches.
  • B. Data fetches: The experiments are positioned against prior electromagnetic studies that examined injection techniques or electrical-level parameters without focusing on produced faults.The related work distinguishes this study’s focus on characterizing data-fetch fault effects.

2) Fault models on microcontrollers:

The paper develops a more precise electromagnetic fault model for a microcontroller by combining black-box experiments with lower-level explanations. Its observations identify instruction, register, data-flow, and bus-transfer effects while acknowledging architectural uncertainty.

  • Scope and approach: The black-box setting constrains practical fault characterization because the microcontroller’s design, architecture, and bus precharge strategy are unknown.The authors use a top-down approach and plan more advanced debugging to obtain more accurate information about executed instructions.
  • Register-transfer level model: The proposed register-transfer level model explains the reported assembly-level results and resembles models for clock and voltage glitches.The authors do not claim it is the only reason assembly-level faults appear.
  • Observed fault effects: Experiments show that electromagnetic glitches can change instructions and alter data loaded from Flash memory.These effects provide the basis for an assembly-level fault model.
  • Observed fault effects: Some instructions or registers appear more vulnerable than others, enabling more specific assembly-level countermeasures.The paper presents vulnerability variation as part of its more accurate fault model.
  • Data-flow effects: Data-flow faults increase the Hamming weight of values loaded from Flash memory on the studied architecture.The authors state that this behavior highly depends on the microcontroller’s bus precharge strategy.
Loading 1402.6421v1…