Experimental evaluation of two software countermeasures against fault attacks

Nicolas Moro (1, 2, 3) , Karine Heydemann (3) , Amine Dehbaoui (4) , Bruno Robisson (5) , Emmanuelle Encrenaz (3)

1 SAS-ENSMSE - Département Systèmes et Architectures Sécurisés
2 CEA-TECH-Reg - CEA Tech en régions
3 ALSOC - Architecture et Logiciels pour Systèmes Embarqués sur Puce
4 SERMA - SERMA Technologies
5 Laboratoire Systèmes et Architectures Sécurisés (LSAS)

Injection of transient faults can be used as a way to attack embedded systems. On embedded processors such as microcontrollers, several studies showed that such a transient fault injection with glitches or electromagnetic pulses could corrupt either the data loads from the memory or the assembly instructions executed by the circuit. Some countermeasure schemes which rely on temporal redundancy have been proposed to handle this issue. Among them, several schemes add this redundancy at assembly instruction level. In this paper, we perform a practical evaluation for two of those countermeasure schemes by using a pulsed electromagnetic fault injection process on a 32-bit microcontroller. We provide some necessary conditions for an efficient implementation of those countermeasure schemes in practice. We also evaluate their efficiency and highlight their limitations. To the best of our knowledge, no experimental evaluation of the security of such instruction-level countermeasure schemes has been published yet.

Mots clés: countermeasure; assembly; instruction skip; fault injection; microcontroller

Domaines: Systèmes embarqués; Cryptographie et sécurité [cs.CR]

Nicolas Moro, Karine Heydemann, Amine Dehbaoui, Bruno Robisson, Emmanuelle Encrenaz. Experimental evaluation of two software countermeasures against fault attacks. 2014 IEEE International Symposium on Hardware-Oriented Security and Trust (HOST), May 2014, Arlington, United States. pp.112-117, ⟨10.1109/HST.2014.6855580⟩. ⟨emse-01032449⟩