On the Effect of Clock Frequency on Voltage and Electromagnetic Fault Injection

Abstract: We investigate the influence of clock frequency on the success rate of a fault injection attack. In particular, we examine the success rate of voltage and electromagnetic fault attacks for varying clock frequencies. Using three different tests that cover different components of a System-on-Chip, we perform fault injection while its CPU operates at different clock frequencies. Our results show that the attack's success rate increases with an increase in clock frequency for both voltage and EM fault injection attacks. As the technology advances push the clock frequency further, these results can help assess the impact of fault injection attacks more accurately and develop appropriate countermeasures to address them.

• The paper demonstrates that increased clock frequency significantly raises the success rate of voltage and electromagnetic fault injection attacks on SoCs.
• The research used assembly-level test loops on the FE310-G000 chip to analyze fault scenarios at different clock speeds.
• Experimental results reveal timing and charge-based vulnerabilities that inform enhanced countermeasure designs for secure SoCs.

Summary of "On the Effect of Clock Frequency on Voltage and Electromagnetic Fault Injection"

The paper "On the Effect of Clock Frequency on Voltage and Electromagnetic Fault Injection" (2310.13389) presents an experimental analysis of how clock frequency influences the success rate of Voltage Fault Injection (VFI) and Electromagnetic Fault Injection (EMFI) attacks on System-on-Chip (SoC) architectures. Using SiFive's HiFive1 development board with the FE310-G000 chip, the research explores fault injection at varying clock frequencies, contributing novel insights into the susceptibility of these systems under physical attack vectors.

Background and Methodology

Fault injection attacks have long been utilized to compromise cryptographic implementations and other security mechanisms in devices such as embedded systems and smart cards. By altering the intended behavior through physical means, attackers can bypass security measures. This paper examines how these attacks succeed with varying clock frequencies on multi-core SoCs, which can operate at different speeds due to external or internal configurations. The introduction of PLL mechanisms and boot flow characteristics in SoCs raised the question of whether the success rate of FI attacks depends on these operational conditions.

Three test applications were developed to capture the effects of faults across different SoC components: register-based loop, memory-based loop, and unrolled loop. Each test aims to investigate different fault scenarios by modifying instructions or data during execution. The tests were implemented in assembly to control execution precisely and avoid compiler optimizations. VFI and EMFI were conducted using a Glitch Generator and EMFI Transient Probe, respectively, with experiments analyzing fault induction across slow, medium, and high clock frequencies.

Experimental Results

Voltage Fault Injection (VFI)

VFI experiments demonstrated that the success rate significantly increases at higher clock frequencies. At 240MHz, numerous successful faults were induced by lowering the glitch voltage while keeping the glitch duration short. Dropping the input voltage temporarily introduced timing constraint violations, more pronounced at higher frequencies due to decreased clock periods.

Observation of Successful Faults: For all clock frequencies:

• Branch Skipping: Occurred when tests unexpectedly continued due to skipped conditional checks.
• Instruction Manipulation: Modifications in immediate values or operations, altering program behavior.

For detailed results, see Figures 6-8.

Electromagnetic Fault Injection (EMFI)

EMFI analysis highlighted that successful faults were isolated to higher frequencies, supporting a charge-based fault model over a purely timing-based one. Optimal position scans showed successful induction near SPI flash memory communication points, indicating susceptibility to external instruction retrieval processes. Attempts at lower frequencies were predominantly ineffective, emphasizing frequency-dependent vulnerability (Figures 3-5).

Discussion

The results illustrate that increasing operating frequency enhances susceptibility to fault injections, both for VFI and EMFI. This aligns with prior studies indicating that higher frequencies reduce clock periods, facilitating timing violations that drive fault occurrences. In practice, stronger glitches necessary at lower frequencies often result in system resets, corroborating the increased inducibility observed at higher rates.

The charge-based fault model appears more applicable to EMFI results, where fault induction coincides with frequency increases. This suggests a more nuanced understanding of faults that incorporate both timing constraints and physical charge disruptions as factors in FI attacks.

Conclusion

The research successfully demonstrates clock frequency's influence on FI attack success rates within modern SoCs. Higher clock frequencies exacerbate vulnerability due to faster operational cycles that facilitate timing and charge-based VA/EMFI attacks. These findings underscore the necessity for robust countermeasures that consider varying operating conditions in SoC design, helping safeguard devices against evolving fault attack methodologies.