Effective software defences against errors created by fault attacks need to anticipate the probable error response of the target micro-controller. The range of errors and their probability of occurrence is referred to as the Fault Model. Software defences are necessarily a compromise between the impact of an error, its likelihood of occurrence, and the cost of the defence in terms of code size and execution time. In this work we first create a fault insertion system and then use it to demonstrate a technique for precisely triggering and capturing individual error responses within a running micro-controller. This enables a more realistic calibration of a micro-controller's fault model. We apply the system to a representative micro-controller and the results show that error insertion is far more predictable than anticipated, and is consistent over a wide range of experimental tolerances. This observation undermines some widely deployed software defences recommended for fault attack protection.
|Number of pages
|Published - 2017
|IEEE International Symposium on Hardware Oriented Security and Trust (HOST) - The Ritz-Carlto, McLean, VA, United States
Duration: 1 May 2017 → 4 May 2017
|IEEE International Symposium on Hardware Oriented Security and Trust (HOST)
|1/05/17 → 4/05/17
- fault model, fault attack, smart card, test rig, micro controller, fault injection, laser pulse, software defence, defensive code, low power, flag corruption, chip surface, hardware defence