design considerations for em pulse fault injection - cvut.cz · 2019. 11. 15. · design...
TRANSCRIPT
![Page 1: Design Considerations for EM Pulse Fault Injection - cvut.cz · 2019. 11. 15. · Design Considerations forEM Pulse Fault Injection Arthur Beckers, Masahiro Kinugawa, Yuichi Hayashi,](https://reader036.vdocuments.mx/reader036/viewer/2022071605/614149066d7bf66e09136db4/html5/thumbnails/1.jpg)
Design Considerations for
EM Pulse Fault Injection
Arthur Beckers, Masahiro Kinugawa, Yuichi Hayashi,
Daisuke Fujimoto, Josep Balasch, Benedikt Gierlichs,
and Ingrid Verbauwhede
CARDIS 2019
![Page 2: Design Considerations for EM Pulse Fault Injection - cvut.cz · 2019. 11. 15. · Design Considerations forEM Pulse Fault Injection Arthur Beckers, Masahiro Kinugawa, Yuichi Hayashi,](https://reader036.vdocuments.mx/reader036/viewer/2022071605/614149066d7bf66e09136db4/html5/thumbnails/2.jpg)
What is EM-fault injection
2
Injection of electromagnetic field into a target IC
Properties:
+ Locality → relatively good spatial resolution (100um - mm)
+ In theory no decapsulation needed → non invasive
+ Relatively good timing resolution
+ Can be done cheaply (100 euro)
- Completely black box behaviour of the device
Injected fields:
o E-field
o H-field
o Combination of both
![Page 3: Design Considerations for EM Pulse Fault Injection - cvut.cz · 2019. 11. 15. · Design Considerations forEM Pulse Fault Injection Arthur Beckers, Masahiro Kinugawa, Yuichi Hayashi,](https://reader036.vdocuments.mx/reader036/viewer/2022071605/614149066d7bf66e09136db4/html5/thumbnails/3.jpg)
H-field EM pulse injection
3
H-field probe characteristics:o Solenoid shape
o Air or ferrite core
o 0.1- 10mm diameter
o 1 - 20 windings
H-field EM pulse characteristics:o ns rise times
o Currents in ampere range
Magnetic flux density : 𝐵 =𝑘𝜇0𝑁
2𝑙𝐼
𝑙
𝑙2+𝑟2
![Page 4: Design Considerations for EM Pulse Fault Injection - cvut.cz · 2019. 11. 15. · Design Considerations forEM Pulse Fault Injection Arthur Beckers, Masahiro Kinugawa, Yuichi Hayashi,](https://reader036.vdocuments.mx/reader036/viewer/2022071605/614149066d7bf66e09136db4/html5/thumbnails/4.jpg)
EM-pulse injection modelling
IC couplingRLC response ( ζ =𝑅
2
𝐶
𝐿)
4
![Page 5: Design Considerations for EM Pulse Fault Injection - cvut.cz · 2019. 11. 15. · Design Considerations forEM Pulse Fault Injection Arthur Beckers, Masahiro Kinugawa, Yuichi Hayashi,](https://reader036.vdocuments.mx/reader036/viewer/2022071605/614149066d7bf66e09136db4/html5/thumbnails/5.jpg)
EM fault injection setup
5
➢ Switching element:• Fast rise time
• Small parasitics
• Consistent timing/ controllable
• E.g Mosfet, IGBT, bipolar transistor,
…
➢ Triggering device:
• High timing resolution
• Small amount jitter
➢ Power supply
• 100-500V DC
➢ Injection probe :
• Characteristics are target dependent
Triggering
Device
Power
supply
![Page 6: Design Considerations for EM Pulse Fault Injection - cvut.cz · 2019. 11. 15. · Design Considerations forEM Pulse Fault Injection Arthur Beckers, Masahiro Kinugawa, Yuichi Hayashi,](https://reader036.vdocuments.mx/reader036/viewer/2022071605/614149066d7bf66e09136db4/html5/thumbnails/6.jpg)
Characterization strategy
➢ Goal: illustrate how different passive
components impact pulse response
➢ Test circuit:
• Gas discharge tube switch (GDT) →
370V breakdown voltage
• 47pF capacitor
• 2mm ferrite core
• 2 windings
➢ Test method:
• 50Ω microstripline
6
μ-strip
C RL
GDT
Power
supply
![Page 7: Design Considerations for EM Pulse Fault Injection - cvut.cz · 2019. 11. 15. · Design Considerations forEM Pulse Fault Injection Arthur Beckers, Masahiro Kinugawa, Yuichi Hayashi,](https://reader036.vdocuments.mx/reader036/viewer/2022071605/614149066d7bf66e09136db4/html5/thumbnails/7.jpg)
Microstripline measurement method
50Ω microstripline response
7
![Page 8: Design Considerations for EM Pulse Fault Injection - cvut.cz · 2019. 11. 15. · Design Considerations forEM Pulse Fault Injection Arthur Beckers, Masahiro Kinugawa, Yuichi Hayashi,](https://reader036.vdocuments.mx/reader036/viewer/2022071605/614149066d7bf66e09136db4/html5/thumbnails/8.jpg)
Probe characterization
μ-strip
C RL
GDT
8
➢Parameters injection circuit:• Capacitance
• Ferrite core diameter
• Number of windings
• Ferrite type
• Winding geometry
![Page 9: Design Considerations for EM Pulse Fault Injection - cvut.cz · 2019. 11. 15. · Design Considerations forEM Pulse Fault Injection Arthur Beckers, Masahiro Kinugawa, Yuichi Hayashi,](https://reader036.vdocuments.mx/reader036/viewer/2022071605/614149066d7bf66e09136db4/html5/thumbnails/9.jpg)
Probe characterization
9
![Page 10: Design Considerations for EM Pulse Fault Injection - cvut.cz · 2019. 11. 15. · Design Considerations forEM Pulse Fault Injection Arthur Beckers, Masahiro Kinugawa, Yuichi Hayashi,](https://reader036.vdocuments.mx/reader036/viewer/2022071605/614149066d7bf66e09136db4/html5/thumbnails/10.jpg)
Probe characterization
10
![Page 11: Design Considerations for EM Pulse Fault Injection - cvut.cz · 2019. 11. 15. · Design Considerations forEM Pulse Fault Injection Arthur Beckers, Masahiro Kinugawa, Yuichi Hayashi,](https://reader036.vdocuments.mx/reader036/viewer/2022071605/614149066d7bf66e09136db4/html5/thumbnails/11.jpg)
EM-pulse faulting mechanism
11
[1] Ordas et al., Evidence of a larger em-induced fault model. CARDIS 2015
![Page 12: Design Considerations for EM Pulse Fault Injection - cvut.cz · 2019. 11. 15. · Design Considerations forEM Pulse Fault Injection Arthur Beckers, Masahiro Kinugawa, Yuichi Hayashi,](https://reader036.vdocuments.mx/reader036/viewer/2022071605/614149066d7bf66e09136db4/html5/thumbnails/12.jpg)
Experimental validation
12
Goal:
demonstrate the impact of the pulse
shape on the fault pattern
Target device:
• STM32F411
• Clock frequency: 100MHz
• Not decapsulated
Target code:
• STM {r0-r9} (store multiple)
• Data: 0x55555555
![Page 13: Design Considerations for EM Pulse Fault Injection - cvut.cz · 2019. 11. 15. · Design Considerations forEM Pulse Fault Injection Arthur Beckers, Masahiro Kinugawa, Yuichi Hayashi,](https://reader036.vdocuments.mx/reader036/viewer/2022071605/614149066d7bf66e09136db4/html5/thumbnails/13.jpg)
EM-fault injector
13
➢ Switching element:• MOSFET, n-channel
➢ Injection probe :
• 0,75mm
• 4 windings
➢ Triggering device:
• Signal generator + Mosfet driver
➢ Power supply:
• 100V - 600 V
➢ Passive components:
• C1: 1000 pF
• R2: 0.22 Ω
• R3: 10 Ω
![Page 14: Design Considerations for EM Pulse Fault Injection - cvut.cz · 2019. 11. 15. · Design Considerations forEM Pulse Fault Injection Arthur Beckers, Masahiro Kinugawa, Yuichi Hayashi,](https://reader036.vdocuments.mx/reader036/viewer/2022071605/614149066d7bf66e09136db4/html5/thumbnails/14.jpg)
Experimental results
Critically damped probe Under damped probe
14
![Page 15: Design Considerations for EM Pulse Fault Injection - cvut.cz · 2019. 11. 15. · Design Considerations forEM Pulse Fault Injection Arthur Beckers, Masahiro Kinugawa, Yuichi Hayashi,](https://reader036.vdocuments.mx/reader036/viewer/2022071605/614149066d7bf66e09136db4/html5/thumbnails/15.jpg)
Conclusion
• Illustrated the impact of the different components on the
pulse shape
• Built an EM-pulse fault injection circuit based on the
previous findings
• Demonstrated the effect different pulse shapes can have
on a fault injection campaign
15