Exploring Fault Injection Attacks on CVA6 PMP Configuration Flow

Kévin Quénéhervé (1, 2) , William Pensec (1, 2) , Tanguy Philippe (1, 2) , Rachid Dafali (3) , Vianney Lapotre (1, 2)

1 Lab-STICC_ARCAD - Equipe Hardware ARchitectures and CAD tools
2 UBS Lorient - Université de Bretagne Sud - Lorient
3 DGA.MI - DGA Maîtrise de l'information

Fault Injection Attacks (FIA) pose significant threats to the security and reliability of embedded systems. FIAs can be used to target an embedded processor by manipulating its clock signal, power supply or by using electromagnetic pulses.

In this study, we analyze FIA on the Physical Memory Protection (PMP) configuration flow of a CVA6 RISC-V core. Fault injection campaigns targeting an FPGA implementation on an ARTY A7-100T board are performed to characterize the fault effects. For that purpose, we rely on clock glitches. Moreover, in order to further characterize the induced faults, Error-Correction Code (ECC) is considered. We extend the ID pipeline stage with hardware modules to filter faults using Hamming code.

Experimental results demonstrate that FIA has multiple effects on the PMP configuration registers. By classifying these effects in regards with injection parameters, we highlight that a given effect can be obtained with high probability by an attacker. Furthermore, thanks to integrated ECC modules used as filters, we confirm that single bit-flips is a prevalent effect in our experiments. Particularly, results demonstrate that numerous fault effects observed in the PMP configuration registers are caused by single bit-flips in the ID stage of the CVA6 core.

Mots clés: Hardware Security Fault Injection Attacks RISC-V Physical Memory Protection Hamming codes FPGA; Hardware Security; Fault Injection Attacks; RISC-V; Physical Memory Protection; Hamming codes; FPGA

Domaines: Architectures Matérielles [cs.AR]; Cryptographie et sécurité [cs.CR]

Kévin Quénéhervé, William Pensec, Tanguy Philippe, Rachid Dafali, Vianney Lapotre. Exploring Fault Injection Attacks on CVA6 PMP Configuration Flow. 27th Euromicro Conference Series on Digital System Design (DSD), Sorbonne University, Aug 2024, Paris, France. ⟨hal-04683083⟩