Design Considerations for EM Pulse Fault Injection
- 25 Downloads
Electromagnetic-fault injection (EM-FI) setups are appealing since they can be made at a low cost, achieve relatively high spatial resolutions, and avoid the need of tampering with the PCB or packaging of the target. In this paper we first sketch the importance of understanding the pulse characteristics of a pulse injection setup in order to successfully mount an attack. We then look into the different components that make up an EM-pulse setup and demonstrate their impact on the pulse shape. The different components are then assembled to form an EM-pulse injection setup. The effectiveness of the setup and how different design decisions impact the outcome of a fault injection campaign are demonstrated on a 32-bit ARM microcontroller.
KeywordsEM fault attack Probe design EM-FI setup
This work was supported in part by the Research Council KU Leuven C1 on Security and Privacy for Cyber-Physical Systems and the Internet of Things with contract number C16/15/058 and through the Horizon 2020 research and innovation programme under Cathedral ERC Advanced Grant 695305. Additionally this work has been partially supported by FWO project VS06717N in collaboration with JSPS.
- 1.Balasch, J., Arumi, D., Manich, S.: Design and validation of a platform for electromagnetic fault injection. In: DCIS 2017, pp. 1–6. IEEE (2017)Google Scholar
- 4.Cui, A., Housley, R.: BADFET: defeating modern secure boot using second-order pulsed electromagnetic fault injection. In: 11th USENIX Workshop on Offensive Technologies (WOOT 2017). USENIX Association, Vancouver (2017)Google Scholar
- 5.Dumont, M., Lisart, M., Maurine, P.: Electromagnetic fault injection: how faults occur. In: FDTC 2019, pp. 9–16. IEEE (2019)Google Scholar
- 6.Giancoli, D.C.: Physics: Principles with Applications. Pearson, Boston (2014)Google Scholar
- 7.Maurine, P.: Techniques for EM fault injection: equipments and experimental results. In: FDTC 2012, pp. 3–4 (2012)Google Scholar
- 8.Moro, N., Dehbaoui, A., Heydemann, K., Robisson, B., Encrenaz, E.: Electromagnetic fault injection: towards a fault model on a 32-bit microcontroller. In: Fischer, W., Schmidt, J. (eds.) FDTC 2013, pp. 77–88. IEEE (2013)Google Scholar
- 9.Omarouayache, R., Raoult, J., Jarrix, S., Chusseau, L., Maurine, P.: Magnetic microprobe design for EM fault attack. In: Catrysse, J., Pissoort, D. (eds.) EMC 2013, pp. 949–954. IEEE Computer Society, Brugge (2013)Google Scholar
- 11.Quisquater, J.J., Samyde, D.: Eddy current for magnetic analysis with active sensor. In: Esmart 2002 (2002)Google Scholar