RTL Fault modeling of laser attacks on RISC-V microarchitectures

University Grenoble Alpes (Valence or Grenoble)

LCIS Laboratory (Valence)

The research activities conducted at LCIS are primarily focused on embedded and communicating systems. The themes addressed include specification, modeling, design, communication, safety, security, and diagnostics of these systems. Within these various themes, the laboratory proposes new methods and models and develops tools that impact industrial applications.

TIMA Laboratory (Grenoble)
The research activities conducted at TIMA are primarily focused on integrated circuits and systems. The themes addressed include specification, design, verification, test, CAD tools, reliability, and security of these systems, from analog and digital components to multiprocessor Systems-on-Chip. Within these various themes, the laboratory proposes new methods and architectures and develops tools, often in collaboration with industrial and academic partners.

Embedded systems are nowadays present in many critical domains, making their security particularly important. Unlike purely software systems, many embedded devices can be physically accessible to an attacker, opening the way to physical attacks. Fault injection attacks are a part of hardware attacks where the attacker tries to change the normal behavior of the circuit by injecting faults. There are many  fault injection techniques that differ in term of cost, accuracy, complexity and observed effects [1].

Laser attacks are considered as one of the most accurate fault injection techniques. They induce a photo-electrical current on the physical level of an integrated circuit, this effect causes different effects on the other abstraction levels.

In the TWINSEC project (ANR-24-RRII-0004), the objective is to build a multi-layer digital twin for embedded systems security. Understanding the link between a physical effect and the observable software behavior is essential to properly evaluate the robustness of an architecture. We are working on open architectures like the CV32E40P and CV32E40S. On the RTL (Register transfer level), the used fault model for laser attacks is the “logic cone” model [2]. This model gives a list of possible faulted Flip-Flops going from a laser spot.

One the main challenges in the security evaluation of complex architectures is the large fault space. As a result, analysis methods based on simulation can require significant computation time. An alternative approach is to use formal methods, which can considerably reduce the analysis effort. Instead of exhaustively testing numerous fault combinations, these methods directly identify consistent fault scenarios. An existing tool that supports this type of analysis is µArchiFi, a tool that finds vulnerabilities that can break security properties of an architecture executing a software [3].

Internship Objectives

Hardware vulnerabilities analysis: The first objective is to analyze the vulnerabilities of laser attacks on the studied architectures. The goal is to evaluate if a fault injected at the hardware level can propagate and lead to the violation of a security property at the software level (verify_pin program).

Fault space reduction: The second objective will be to analyze logic and timing masking effects, since not all the faults given by the logic cone model can propagate to the Flip-Flops. Removing them will reduce the initial fault space to the most relevant vulnerabilities.

Hardware-software cross-layer analysis: The third objective will be to derive software fault models from the hardware vulnerabilities identified in the previous steps and to classify these models according to the faulty behaviors they induce (such as instruction skip or data corruption). By correlating the architectural components and signals responsible for these vulnerabilities with the software-level effects that lead to security violations, we aim to obtain software fault models that are consistent with both the RTL fault model under consideration and the target architecture.

No experimental attacks will be performed. These analyses will rely on formal methods and RTL simulation.

Master in microelectronics, or embedded systems, or security.

Required Skills:

• C and assembly programming
• HDL languages (VHDL, Verilog or systemVerilog)
• Embedded systems (microcontrollers or FPGA) and processors architecture (RISC-V)
• Interest in hardware security