Fault Attacks on Embedded Software: Threats, Design, and Mitigation - PowerPoint PPT Presentation

Fault Attacks on Embedded Software: Threats, Design, and Mitigation Patrick Schaumont Professor Bradley Department of ECE Virginia Tech Acknowledgements FAME Project Team https://sites.google.com/view/famechip Supported through National Science Foundation Semiconductor Research Corporation Patrick Schaumont (VT) 1

Objective The black‐box model input Fault Injection ? (Secure) ? ? SW ? output output’ correct faulty behavior behavior Fault Analysis Patrick Schaumont (VT) 2

Objective The black‐box model The grey‐box model input Fault Injection ? (Secure) ? ? SW ? output output’ correct faulty behavior behavior Fault Analysis Patrick Schaumont (VT) 3

Objective The black‐box model The grey‐box model input Fault Injection Fault (Secure) SW Injection (Secure) SW Manifestation Microprocessor Propagation Observation output output’ Mem Hierarchy Exploitation correct faulty behavior behavior Fault Analysis Patrick Schaumont (VT) 4

Objective The black‐box model The grey‐box model input Fault Injection Fault (Secure) SW Injection (Secure) SW Manifestation Microprocessor Propagation Observation output output’ Mem Hierarchy Exploitation correct faulty behavior behavior • Make a systematic review of the fault‐attack process on embedded software Fault Analysis Patrick Schaumont (VT) 5

Outline 1. Introducing the Fault Attack 2. Anatomy of a Fault Attack 3. Fault Injection Techniques 4. Manifestation and Propagation in the ISA 5. FAME – A Mitigation Technique for Microprocessors Patrick Schaumont (VT) 6

Attacks on Embedded Software I/O CPU MEM • Embedded Software assumes execution is correct • (This presentation) Incorrect execution as starting point for attack ‐ Privilege Escalation ‐ Information Leakage Patrick Schaumont (VT) 7

Privilege Escalation & Information Leakage • Privilege Escalation = Adversarial Control of Critical Decisions if (! access_allowed ) abort( ); • Information Leakage = Disclosure of Secret Data & Dependencies r1 if (key_bit) out = f(r1); else out = f(r0); key_bit leaks through out Patrick Schaumont (VT) 8

Triggering Incorrect Execution I/O CPU MEM Attacker Attack Target Security Failure Input/Output Attacker Input/Output Data Software Bugs Memory Attacker Application/Task Image Lack of Mem Isolation Hardware Attacker Instruction Opcode Modification Instruction Execution Micro-Architecture Circuit Timing, Threshold Levels Environment Operating Conditions this talk Patrick Schaumont (VT) 9

Outline 1. Introducing the Fault Attack 2. Anatomy of a Fault Attack 3. Fault Injection Techniques 4. Manifestation and Propagation in the ISA 5. FAME – A Mitigation Technique for Microprocessors Patrick Schaumont (VT) 10

Anatomy of a Fault Attack 1. Fault Attack Design • Fault Target and Fault Model Defined by • Fault Injection Method Security (Attack) Objective • Fault Exploitation Method 2. Fault Attack Implementation • Fault Injection • Fault Manifestation Constrained by • Fault Propagation Implementation • Fault Observation • Fault Exploitation Patrick Schaumont (VT) 11

Anatomy of a Fault Attack electrical transient Fault Injection Physical Level Patrick Schaumont (VT) 12

Anatomy of a Fault Attack faulty bits Fault Manifestation Circuit Level electrical transient Fault Injection Physical Level Patrick Schaumont (VT) 13

Anatomy of a Fault Attack Hardware faulty micro‐op Decode Execute Fault Propagation Datapath Control Micro‐Architecture D‐Fetch I‐Fetch Store Level Status Regs Instruction Memory Register File Data Mem Boot ROM faulty bits Fault Manifestation Circuit Level electrical transient Fault Injection Physical Level Patrick Schaumont (VT) 14

Anatomy of a Fault Attack S P 1 int verify(S,P){ 1 Faulty int r; Application S,P 2 if (S = P) Control Flow 2 OS r = 1; 3 and/or else Data Flow Firmware 3 4 4 r = 0; r r 5 return r Fault Observation 5 } faulty instruction Software Instruction Set Architecture Hardware faulty micro‐op Decode Execute Fault Propagation Datapath Control Micro‐Architecture D‐Fetch I‐Fetch Store Level Status Regs Instruction Memory Register File Data Mem Boot ROM faulty bits Fault Manifestation Circuit Level electrical transient Fault Injection Physical Level Patrick Schaumont (VT) 15

Anatomy of a Fault Attack S P 1 int verify(S,P){ Fault Exploitation 1 Faulty int r; Application S,P 2 if (S = P) Control Flow 2 OS r = 1; 3 and/or else Data Flow Firmware 3 4 4 r = 0; r r 5 return r Fault Observation 5 } faulty instruction Software Instruction Set Architecture Hardware faulty micro‐op Decode Execute Fault Propagation Datapath Control Micro‐Architecture D‐Fetch I‐Fetch Store Level Status Regs Instruction Memory Register File Data Mem Boot ROM faulty bits Fault Manifestation Circuit Level electrical transient Fault Injection Physical Level Patrick Schaumont (VT) 16

Outline 1. Introducing the Fault Attack 2. Anatomy of a Fault Attack 3. Fault Injection Techniques 4. Manifestation and Propagation in the ISA 5. FAME – A Mitigation Technique for Microprocessors Patrick Schaumont (VT) 17

Fault‐injection Control Hardware‐controlled Software‐controlled Fault Injection Fault Injection Software Tasks Fault Injection Hardware CTL/Injection Victim Fault Control Injector Timing Physical Stress Physical Stress I/O CPU I/O CPU MEM MEM Patrick Schaumont (VT) 18

Timing Vdd Temp logic clk nominal clock period critical path + slack Patrick Schaumont (VT) 19

Artificial Timing Faults Vdd Temp logic clk shortened clock period • Overclocking • critical path Clock Glitching ‐ slack Timing Violation nominal clock period • Underfeeding • Voltage Glitching increased critical path • Overheating ‐ slack Patrick Schaumont (VT) 20

Noise Injection ‐ EMFI Faraday’s Law E = ‐A . dB logic dt E clk Area A Field B di dt Patrick Schaumont (VT) 21

Noise Injection ‐ EMFI Faraday’s Law E = ‐A . dB logic dt E clk Area A Field B di dt Patrick Schaumont (VT) 22

Noise Injection – Laser Faults Glitches Single Event Upset Laser Beam Vdd on 1 0 Flip off Photocurrent Vss Laser Beam Patrick Schaumont (VT) 23

Software‐Controlled Faults • DVFS Interface (CLKSCREW) f1 PLL Core1 f2 software controlled Programming timing violation by modified (V2,f2) Interface V1 PMIC Core2 V2 • Memory Disturbance software controlled leak charge @ repeated word access word row 0 row 1 bit row 2 row buffer Patrick Schaumont (VT) 24

Fault Injection Portfolio Fault Injection Spatial Temporal Cost Intensity Precision Precision Overclocking Low Low Low Clock f Clock Glitching Low High Low Glitch Width Underfeeding Low Low Low Voltage Voltage Glitching Low High Low Glitch V/W Overheating Low Low Low Temperature Light Pulse Medium Medium Low Pulse W/Enrgy Laser Pulse High High High Pulse W/Enrgy EM Pulse Medium High High Probe Current DVFS Interface Low Medium Zero V/f Memory Disturbance High Medium Zero Disturbance f Patrick Schaumont (VT) 25

Outline 1. Introducing the Fault Attack 2. Anatomy of a Fault Attack 3. Fault Injection Techniques 4. Manifestation and Propagation in the ISA 5. FAME – A Mitigation Technique for Microprocessors Patrick Schaumont (VT) 26

Processor Micro‐architecture • Instruction Semantics & Syntax • Memory Model Programmer’s Model • Interrupt/Exception Interface Instruction Set Architecture Instruction Memory Fetch Control Micro‐Architecture Decode Flags Datapath Load Store Data Mem RegFile Patrick Schaumont (VT) 27

Processor Micro‐architecture Faults • Instruction Semantics & Syntax Faulty Instruction • Memory Model Programmer’s Model • Interrupt/Exception Interface Propagation Instruction Set Architecture Manifestation Instruction Memory • Fault Location Fetch • Fault Effect • Control Fault Duration Micro‐Architecture • Fault Size Decode Flags Datapath Load Store Data Mem RegFile Patrick Schaumont (VT) 28

Processor Micro‐architecture Faults Micro‐architecture Element Instruction‐memory Instruction‐fetch Instruction‐decode Operand‐fetch Execute Store Data‐memory Register File Status Flags Patrick Schaumont (VT) 29

Processor Micro‐architecture Faults Micro‐architecture Element Instruction‐memory Function Operand Immediate Instruction‐fetch Different Different Different instruction source/dest Instruction‐decode value Operand‐fetch Execute Store Data‐memory Register File Status Flags Patrick Schaumont (VT) 30