Fault Injection Attacks

Transcription

1 Fault Injection Attacks Attack Methodologies, Injection Techniques and Protection Mechanisms Shivam Bhasin and Debdeep Mukhopadhyay Temasek Laboratories, NTU Singapore IIT Kharagpur, India ESP-Research, India SPACE 2016 Invited Tutorial Hyderabad, India. 15 December 2016

2 Tutorial organization Part I: Practical Aspects Background Injection techniques Protection Methods Part II: Theoretical Analysis Brief History Differential Fault Analysis Biased Fault & Countermeasures Fault Tolerance S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 2 / 37

3 1 Context 2 Fault-Injection Attacks (FIA) 3 Fault-Injection Techniques 4 Fault Protection 5 Conclusions

4 1 Context 2 Fault-Injection Attacks (FIA) 3 Fault-Injection Techniques 4 Fault Protection 5 Conclusions

5 Internet of Things Source: S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 3 / 37

6 Internet of Things IoT Trends Population: 4.9 Billion (2015) to 25 Billion (2020) Market: $69.5 Billion (2015) to $263 Billion (2020) Source: Gartner, Inc., Nov 2014 Source: S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 3 / 37

7 Internet of Things Critical Applications of IoT Aerospace. Automotive. Energy. Health Care. Transportation.... S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 3 / 37

8 Internet of Things Critical Applications of IoT Aerospace. Automotive. Energy. Health Care. Transportation.... Vulnerable Devices Smart devices: smartcards, tags, IoT sensors; Storage devices: USB sticks, hard-drives; Security devices: HSM; Computing devices: cloud. S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 3 / 37

9 Why Should We Care? Why is Hardware Vulnerable? IoT is breaking traditional boundaries and locals. Devices are present anywhere and everywhere, outsourced. Some deployments are in hostile environments. Adversary has physical access. Are traditional protection enough? S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 4 / 37

10 Common Threats to IoT Software Attacks Source: S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 5 / 37

11 Common Threats to IoT Counterfeits Source: S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 5 / 37

12 Common Threats to IoT Physical Attacks Source: S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 5 / 37

13 Common Threats to IoT Hardware Trojans Source: S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 5 / 37

14 1 Context 2 Fault-Injection Attacks (FIA) 3 Fault-Injection Techniques 4 Fault Protection 5 Conclusions

15 Fault Injection Attacks (FIA) S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 6 / 37

16 Overview of Fault Injection Techniques Low-Cost and Global Power Glitch Clock Tampering Temperature Variation High-Cost and Local Light/Laser Injection EM Injection Focused Ion Beam S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 7 / 37

17 Impact of Fault Injection Fault Duration Transient Harmonic Fault Effects Data Modification Flow Modification Fault Objectives Bypass Security Check Corrupt Computation Bias inputs S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 8 / 37

18 Fault Models Single/multiple bit-flip a target variable was altered either by single or multiple bit flip. Random byte fault Some bits of a byte are flipped. No-precise multi-bit flip. Instruction skip One or several instructions were not executed (for software) Stuck-at fault target variable stuck at-0/1. S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 9 / 37

19 Overview of Fault Protection Two Approaches: Fault Detection Fault Prevention Fault Detections Incremental Approach Analog Method: Detect physical stress Digital Method: Detect modification of digital data Fault Prevention Provable Approach Infect/Erase Output S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 10 / 37

20 Real World Examples Pentium FPU bug attack Bug in Intel P5 floating point unit Outputs wrong result (1 in 9 billion) Shamir proposed attack to retrieve RSA key Can be performed remotely PS3 Hack otheros feature allows boot of Linux Glitch allows hypervisor access Attacker gain full memory access Control of Os bootchain S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 11 / 37

21 1 Context 2 Fault-Injection Attacks (FIA) 3 Fault-Injection Techniques 4 Fault Protection 5 Conclusions

22 Fault Injection Techniques Widely classified as: Global + Low-cost + Applicable on range of devices + Low expertise required - Limited precision Local + Precise and powerful + Can bypass basic protections - High expertise required - Expensive equipments S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 12 / 37

23 Global Fault Injection: Power Main Idea: Disturb the power supply to induce faults. Modes: short-lived glitch, source manipulation Equipment: Low cost basic lab equipment Attacker can feed higher or lower power. Potential for remote execution S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 13 / 37

24 Global Fault Injection: Power Glitches effect are short-lived. Are generally used for skipping key instruction Timing of the glitch is the key Widely used in to tamper paytv cards in 90 s Typically used to skip watchdog counter or sanity checks Power supply can filter some glitches S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 13 / 37

25 Global Fault Injection: Power Under/Over-powering over prolonged period can also be used for fault injection Underpowering increases signal propagation delay Can lead to setup time violation in hardware platforms In microcontrollers, power hungry instruction are worst hit (memory read/write) Overpowering causes electrical anomalies Capable of bit-flips S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 13 / 37

26 Global Fault Injection: Power Recent addition: Body Bias Injection Requires access to substrate of the chip (backside) A needle is used to inject power directly in the substrate Direct access and can bypass glitch detectors Powerful but needs basic profiling S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 13 / 37

27 Global Fault Injection: Clock Main Idea: Disturb the clock to induce faults. Modes: short-lived glitch, source manipulation Equipment: Low to medium cost equipment Overclocking is typically used S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 14 / 37

28 Global Fault Injection: Clock Clock Glitch S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 14 / 37

29 Global Fault Injection: Clock Clock is a vital resource of electronic circuits A clock glitch can be used to reduce period of a one to few operations Reduced period leads to wrong computation i.e. fault Again timing is the key Constant overclocking can inject faults in critical path Capable of bit-flips S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 14 / 37

30 Global Fault Injection: Temperature Main Idea: Operate in non-nominal conditions Equipment: Low cost Both cold and hot temperature can be used Lacks precision S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 15 / 37

31 Local Fault Injection: Light Main Idea: High energy light to induce faults. Modes: intense flash lamps, laser beam Equipment: Medium to high cost High precision and repeatability Needs chip preparation S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 16 / 37

32 Local Fault Injection: Light 0 V DD PMOS observed current a transient can be further propagated V SS N+ N+ LASER P substrate Impact of Laser on Transistor S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 16 / 37

33 Local Fault Injection: Light 0 V DD PMOS observed current a transient can be further propagated V SS LASER N+ N+ P substrate Photoelectric effect - when a laser beam with a wavelength corresponding to an energy level higher than the silicon bandgap passes through silicon, it creates electrons-hole pairs along its path. If the laser beam passes through the reverse-biased PN junction of a transistor, charge carriers can be drifted in opposite directions and a current pulse is created. This current pulse creates a transient voltage pulse which propagates through the combinatorial logic of the IC. S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 16 / 37

34 Local Fault Injection: Light This phenomenon is called a Single Event Transient (SET) Fault is induced if a SET propagates through the logic and is captured by a register Single Event Upset (SEU) occurs when the transient voltage is directly induced into a SRAM or a register: it flips and locks its state to the opposite one It is desired to adjust power for faults but avoiding damages. S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 16 / 37

35 Local Fault Injection: Light Laser can be injected from frontside or backside of the chip Frontside is more effective with smaller wavelength Modern ICs with several metal layers make it less effective Backside injection is more suited with near infrared (NIR 1064nm) Silicon substrate is transparent to NIR S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 16 / 37

36 Decapsulation Main Idea: Open the package to access the chip Equipment: Chemical or Mechanical Semi-Invasive Method Can be fatal to the chip S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 17 / 37

37 Back Side Decapsulation (Mechanical) (i) (iii) (ii) (iv) S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 18 / 37

38 Back Side Decapsulation (Mechanical) (i) (iii) (ii) (iv) S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 18 / 37

39 Front Side Decapsulation (Chemical) S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 19 / 37

40 Front Side Decapsulation (Chemical) fuming nitric acid Molding compond destroyed bounding wires Molding compond Substrate Die Substrate Die Solution 1: Complete unpacking FPGA chip mill down Molding compond fuming nitric acid Molding compond Molding compond Substrate Die Substrate Die Substrate Die Solution 2: Partial unpacking FPGA chip Substrate Die Substrate Die Substrate Die Solution 3: Up-Side Down Partial unpacking FPGA chip S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 19 / 37

41 Front Side Decapsulation (Chemical) Alive Chip Broken Chip S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 19 / 37

42 Local Fault Injection: Electromagnetic (EM) Main Idea: High energy EM field to induce faults. Modes: pulse, harmonics Equipment: Medium to high cost Less precise than laser No need of chip preparation S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 20 / 37

43 Local Fault Injection: Electromagnetic (EM) digital glitch plaintexts ciphertexts probe tip EMFI probe pulse current in coil glitch generator trigger signal controller board Basic EM Injection Setup FPGA die target FPGA board motorized 2D stage S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 20 / 37

44 Local Fault Injection: Electromagnetic (EM) Low voltage harmonics constantly bias the target Generally used for analog blocks like RNG Alternatively intense, short pulses can disturb particular operation Suited for digital blocks like logic/memories Can penetrate several metal layers Probe design is a key expertise S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 20 / 37

45 Local Fault Injection: Focused Ion Beam (FIB) Main Idea: High energy ion beam to induce faults. Equipment: very high cost Can make permanent faults Very high precision S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 21 / 37

46 Local Fault Injection: Focused Ion Beam (FIB) Source: S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 21 / 37

47 1 Context 2 Fault-Injection Attacks (FIA) 3 Fault-Injection Techniques 4 Fault Protection 5 Conclusions

48 Fault Protection Two Approaches: Detection Detect injection attempts A recovery mechanism is followed Normally characterised by detection rate Overhead widely varies Information-level methods detect data modification Circuit-level methods perform sanity checks on physical parameters Prevention Provable approach Either corrects or infects a fault can have huge overheads Data retrieved by attacker is not exploitable A combination of both is often desired S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 22 / 37

49 Detector Based Protection Eligible sensor/detector should sense physical disturbance Desirably independent of the target to contain the overhead offer higher senstivity to physical disturbance Should react in real-time Security margin: Power, Space. S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 23 / 37

50 Global Detector Glitch on power or clock is a common injection technique Analog glitch detectors can be in-built into the IC Checks for voltage range, clock frequency etc. Out of range operation, triggers recovery. S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 24 / 37

51 Global Detector Digital detectors can be integrated Monitors underpowering or overclocking Calibration can be hard and limiting factor Also can be used for EM detection Source: Despande et al. A Configurable and Lightweight Timing Monitor for Fault Attack Detection. ISVLSI 2016 Source: Selmane et al. WDDL is Protected Against Setup Time Violation Attacks. FDTC 2010 S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 24 / 37

52 Laser Detector Laser injects high-energy using an intense beam Detailed cartography is required to determine PoI Integrated detectors can be deployed to detect laser Analog detectors are generally based on photodiodes Similar functionality can be detected by custom logic S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 25 / 37

53 RO-Based Laser Detector Ring oscillator (RO) has tendency to stabilise A high-energy by laser will disturb RO oscillations This forces RO to loose the lock S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 26 / 37

54 RO-Based Laser Detector RO can be used as laser watchdog PLL is used to detect the lock PLL is a widely used analog component in circuitries for providing stable and precise clock source. The lock signal of PLL detects laser injection S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 26 / 37

55 RO-Based Laser Detector High detection rate Offers great power and security margin S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 26 / 37

56 RO-Based Laser Detector PLL can be replaced by all-digital logic Low-cost, high sensitivity and versatile Can also be used to detect glitches S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 26 / 37

57 RO-Based Laser Detector PLL can be replaced by all-digital logic Low-cost, high sensitivity and versatile Can also be used to detect glitches PLL-based Sensor (left) vs All-Digital Sensor (right) S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 26 / 37

58 EM Detector EM also injects high-energy pulses Impact area much larger than laser Some solution use local glitch detector for EM Recent work [Miura et al.] proposed RO+PLL for EM detection Can also replace with digital detector Differs in RO routing from laser version S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 27 / 37

59 EM Detector Security enhanced repeater mode by merging Ref clock with watchdog clock. RO-based internal clock to prevent advanced attacks like FSA Area Overhead: 1 LUT (RO) + 1 PLL + Routing resources LSM Locked EMI Up Down Rclk Cclk Crypto Core PLL Watch-Dog Clock Paths (a) Repeater Configuration Rclk Up LSM PLL Down Locked Cclk Watch-Dog Clock Paths Crypto Core EMI (b) Ring-Oscillator (RO) Configuration S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 27 / 37

60 EM Detector 1 Probability Security Margin EM Pulse Detected Fault Injected Undetected Faults EM Pulse Injection Power (dbm) Security Margin = 19dBm S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 27 / 37

61 EM Detector (a) Detection Rate (b) Undetected Faults 2-D Area Scan (XY axes) Scan precision 1.0µm, Scan Matrix Undetected Fault Probability 0.01 S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 27 / 37

62 Complex Package IC Packages are becoming more complex Multiple component are stacked 3-D ICs taking it to next level Hard to target inner layers (ex. Memory) Source: S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 28 / 37

63 Error Detection Principle: Application of error detection codes Widely studied and used in communications Ensures data integrity Basic example is parity Generally applied on linear operations Can have significant overheads S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 29 / 37

64 Redundancy Principle: Repeat and compare Several variants: Compute twice, Compute forward and inverse etc. Equivalent to duplication in space or time Software duplicates in time Hardware can duplicate in space or time Compute forward and inverse shows more robustness At least 2 overhead S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 30 / 37

65 Redundancy Redundancy For Fault Detection Source: Lomne et al. : Fault Attacks and Countermeasures: A Survey S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 30 / 37

66 Special Logic Style Special representation of data to balance power consumption (ex. WDDL, BCDL) Introduced for side-channel protection Shown to have fault resistance by Selmane et al. High overheads A B G Single rail Y A T B T G Dual rail Y T A F B F G Y F A Basic WDDL Gate with Fault Resistance Source: Selmane et al. WDDL is Protected Against Setup Time Violation Attacks. FDTC 2010 S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 31 / 37

67 Software Encoding Protection Information redundancy at software level Equivalent of special logic styles in software Data representation is modified to enable fault detection Some variant can also infect faults Initially proposed for side-channel protection Also demonstrate fault detection capabilities S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 32 / 37

68 Software Encoding Protection Assembly level Code Analyzer for fault resistance Supports several fault models. Fault Injection Simulator Fault Model bit flip random byte fault instruction skip stuck-at fault r4 = r4 ' = Fault Position Instruction Set Simulator Input a = b = LDI LDI EOR ST x = Output Target Code r4 r5 r4 c... a b r5 r4 Validator x = ? Valid/Invalid Output Checker Source: Breier et al. The other side of the coin: Analyzing software encoding schemes against fault injection attacks. HOST 2016 S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 32 / 37

69 Software Encoding Protection Static Device-Specific Encoding DPL Fault model XOR LUT XOR XOR Single bit flip No No No Yes Double bit flip Yes Yes Yes Yes Single instruction skip No No Yes Yes Double instruction skip Yes No Yes Yes Stuck-at fault Yes No No No S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 32 / 37

70 Software Encoding Protection 1.0 Valid Invalid 0.8 Null Stuck-At 2-Ins. Skip 1-Ins. Skip 2-Bit Flip 1-Bit Flip Static DPL XOR 1.0 Valid Invalid 0.8 Null Stuck-At 2-Ins. Skip 1-Ins. Skip 2-Bit Flip 1-Bit Flip Static Encoding LUT 1.0 Valid Invalid 0.8 Null Stuck-At 2-Ins. Skip 1-Ins. Skip 2-Bit Flip 1-Bit Flip Static Encoding XOR 1.0 Valid Invalid 0.8 Null Stuck-At 2-Ins. Skip 1-Ins. Skip 1-Bit Flip 2-Bit Flip 3-Bit Flip 4-Bit Flip 5-Bit Flip 6-Bit Flip 7-Bit Flip 8-Bit Flip Device Specific XOR S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 32 / 37

71 Infection Principle: Tamper faulty value It prevents attacker from exploiting the fault Similar to repeat and compare scheme Faulty value is further diffused or randomised. At least 2 overhead S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 33 / 37

72 Control Flow Principle: Verify the code execution sequence Applies to microcontrollers Modern microcontrollers can verify if the code was properly executed Verification of executed code signature against precomputed signature Cryptographic hash is a popular candidate for signature generation Overhead in terms of signature omputation and comparison If the target code is small, hashing can have big overheads Simpler signature schemes are then desired S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 34 / 37

73 Randomization Principle: Randomization reduces precision Most fault injection requires precise timing Timing randomization reduces attack precision and strenthens detection Jitter, dummy operations, shuffling are common techniques S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 35 / 37

74 1 Context 2 Fault-Injection Attacks (FIA) 3 Fault-Injection Techniques 4 Fault Protection 5 Conclusions

75 Conclusion Fault attacks are powerful branch of physical attacks The techniques vary in precision and cost Voltage and clock based are commonly used low-cost techniques Laser is most precise but needs high cost and expertise EM is a new and interesting alternative Faults can be combined with other physical attacks A range of countermeasures was presented Generally a combination is required to ensure high security S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 36 / 37

76 Thank you! Any questions? S. Bhasin & D. Mukhopadhyay Fault Injection Attacks 37 / 37