Electromagnetic fault injection: towards a fault model on a 32-bit microcontroller (1402.6421v1)

Abstract: Injection of transient faults as a way to attack cryptographic implementations has been largely studied in the last decade. Several attacks that use electromagnetic fault injection against hardware or software architectures have already been presented. On microcontrollers, electromagnetic fault injection has mostly been seen as a way to skip assembly instructions or subroutine calls. However, to the best of our knowledge, no precise study about the impact of an electromagnetic glitch fault injection on a microcontroller has been proposed yet. The aim of this paper is twofold: providing a more in-depth study of the effects of electromagnetic glitch fault injection on a state-of-the-art microcontroller and building an associated register-transfer level fault model.

• The paper investigates electromagnetic fault injection (EMFI) on 32-bit microcontrollers, proposing a register-transfer level fault model based on experimental analysis.
• Key findings show fault induction is sensitive to pulse amplitude, probe position, and instruction type, noting flash memory accesses are more vulnerable than SRAM.
• The proposed model suggests EMFI predominantly affects the HRDATAI bus during flash access, often causing a set-at-1 or Hamming weight increase fault characteristic.

An Examination of Electromagnetic Fault Injection on 32-bit Microcontrollers

The paper under review investigates the application of electromagnetic fault injection (EMFI) on modern 32-bit microcontrollers, particularly those built on ARM Cortex-M3 processors. The research aims to uncover the effects of such injection schemes and to propose a model that accurately describes the faults induced at the register-transfer level.

Core Objectives and Investigative Approach

The paper is principally concerned with elucidating the impact of electromagnetic glitches on microcontroller operations and developing a fault model that characterizes the effects of these injections. The authors emphasize the need for precise fault control, fundamental for the success of any fault attack, and concentrate on analyzing how electromagnetic pulses disrupt the computations within a microcontroller.

To achieve this, the authors establish an experimental setup inclusive of a control computer, an electromagnetic fault injection bench, and a motorized stage for precise positioning of the electromagnetic probe. Faults are induced through pulse generation, with specific focus on variables such as pulse amplitude, width, and timing.

Experimental Observations and Numerical Results

A series of experiments delve into various parameters impacting fault induction:

1. Pulse Amplitude and Timing: The amplitude was shown to directly influence Hamming weight increases in data values fetched from the instruction bus, exemplifying a clear relationship between higher voltages and increased fault occurrence.
2. Spatial Positioning of Antenna: The X Y positioning of the injection probe dramatically affects the fault induction's efficacy. Specific probe positions resulted in targeted faults without impacting adjacent circuits.
3. Instruction Type Sensitivity: Load instructions retrieving data from flash memory were notably more susceptible to faults than those accessing SRAM, attributable to more significant response time differentials in flash memory accesses.

The authors observed metastability, where the same fault injection configuration resulted in varying outcomes, highlighting the complexity of timing fault behaviors.

Proposed Fault Model and Theoretical Implications

At the conclusion of their empirical studies, the authors propose a fault model based on the premise that EMFI most critically affects the HRDATAI bus transfers when dealing with flash memory. The data flow exhibits a predisposition towards faults that increase the Hamming weight of fetched values, underlining a potential precharge of bus lines. This set-at-1 model contrasts with the varied instruction replacement phenomena observed in program flow disruptions, offering a nuanced perspective on fault characteristics unique to electromagnetic injections.

Implications and Future Directions

The implications of this research are significant, highlighting vulnerabilities in microcontroller designs that attackers might exploit using EMFI techniques. The specificity of faults found in the data flow—largely influenced by bus precharge conditions—suggests potential pathways for designing robust countermeasures that could protect against unauthorized alterations to microcontroller operations.

Avenues for future research include refining EMFI techniques to more precisely understand their impacts at varying abstraction levels and exploring the interplay between different fault injection methodologies. The paper lays a foundational understanding that can fuel the development of more resilient security mechanisms that factor in the unique intricacies of electromagnetic interference.

By providing both practical and theoretical insights into fault mechanics at a granular level, the research provokes a reevaluation of existing security assumptions in embedded systems and advocates for addressing hardware-level weaknesses through advanced fault characterization and mitigation strategies.