Laser Fault Injection Exploration on System-on-Chip

Laser Fault Injection Exploration on System-on-Chip

Soline Casavecchia (CEA LETI)

Abstract. Fault injections on integrated circuits aim to modify the target’s intended behaviour, often to the benefit of an attacker. System-on-chips (SoCs), used nowadays in smartphone-type devices, are a particularly sensitive target of interest. Most SoCs usually do not take into account the potential threat of hardware attacks when they are designed, especially compared to other integrated circuits like Secure Elements. As such, there is potential in exploring their vulnerabilities to laser fault injection (LFI), especially since LFI remains overall unstudied compared to other physical attacks such as electro-magnetic fault injection (EMFI) on SoCs. This work aims to provide a more comprehensive study of potential LFI affecting both the CPU and cache of a SoC.

The present work focuses on a quad-core ARMv7 SoC running a Linux Yocto OS. The objective was to tackle the difficulty of finding areas of interest on the large die surface and then successfully injecting and identifying dynamic faults, thus proposing an amended methodology to conventional fault injection campaign processes on microcontrollers, particularly with the use of photon emission analysis. The chip was first constrained to run on a single CPU at its maximum frequency. Photon emission was then used to identify the four CPU cores one at a time, as well as to obtain a general assessment of the CPU’s activity through its light output for various operations. Furthermore, photon emission was also used to understand the L1 data cache structure of the target. With Photon Emission Microscopy (PEM) reflecting the chip activity through the transistors emitting light when switching, it was possible to narrow down the areas to explore in LFI. When attacking the CPU itself, a 100% repeatability was achieved for modifying the source register of an ADD instruction, as well as an 85% repeatability for exiting a loop prematurely by faulting a conditional branch instruction. Both of these faults were obtained with the laser pulse by targeting the while loop during its runtime, with the duration of the laser pulse encompassing multiple instructions. Other experiments, dynamically targeting cache memory buffers, made it possible to change the value loaded in the registers during the runtime of the code under attack. Single bit faults were injected in the data read by the six used working registers, with an on-average repeatability of 25%, which can be explained by the fact that the target data are stored randomly in one of the four-way cache.