E"MATA&HARI& Electromagne4c&Analysis,&Deciphering&and& Reverse&Engineering&of&Integrated&Circuits&

Transcription

1 E"MATA&HARI& Electromagne4c&Analysis,&Deciphering&and& Reverse&Engineering&of&Integrated&Circuits& Laurent(Chusseau,(Rachid(Omarouayache,(Jérémy(Raoult,(Sylvie(Jarrix,( Philippe(Maurine,(Karim(Tobich,(Alexandre(Boyer,(Bertrand(Vrignon,(John(Shepherd,( ThanhEHa(Le,(Maël(Berthier,(Lionel(Rivière,(Bruno(Robisson,(AnneELise(RiboIa( ( IES$(Montpellier),$LIRMM$(Montpellier),$LAAS4CNRS$(Toulouse),$Freescale$(Toulouse),$ Safran$Morpho$(Osny),$CEA4LETI$(Gardanne),$ENSMSE$(Gardanne)$

2 Context&&&Goals& Context& Electronic(money(transacKons( Private(communicaKons(and/or(secret(data(exchange( Need(for(cerKfied(secure(IC(both(at(soQware(and(hardware(level( State&of&the&art& Cryptographic(aIacks(on(circuits(are(usually(managed(by(opKcal(injecKon(or(by(conducted( interference(injeckon(( ElectromagneKc(aIacks(have(just(been(proven(efficient(by(some(of(us(( Goals & What(can(be(observed,(at(best,(in(an(integrated(circuit((IC)(by(EM(nearEfield(scan?( Why(and(how(EM(fault(injecKon(works?( What(are(the(pracKcal(and(theoreKcal(limits(of(EM(threats?( Requirements& Knowledge(of(crypto(circuits(at(hardware(level((LIRMM,(CEA,(Freescale,(Morpho)( Knowledge(of(crypto(circuits(at(soQware(level((Morpho,(LIRMM,(CEA)( ElectromagneKc(nearEfield(/(Probes:(design(and(realizaKon((IES,(LAAS,(Freescale)( Skill(in(logic(circuit(EMC((LAAS,(Freescale,(IES)( EM(aIacks((LIRMM,(CEA,(ENSMSE)(

3 Summary& Probes(:(design,(fabricaKon(&(characterizaKon( OpKmized(new(probes( Dedicated(test(chips( EM(coupling(experiments(&(models( mmewave(imagery( EM(aIacks(on(circuits( EM(pla_orm( EM(fault(injecKon(in(AES( BitEset(&(bitEreset( Fault(propagaKon(modeling(

4 How&an&EM&fault&occurs&?& Classical loop probe (diameter 2-5 mm) Substrate Pulse injection in probe! Courant induction in lines! Local power supply voltage change or Local logic level change! Fault! Probe figure of merit - Spatial resolution - Injection efficiency Magnetic probes are more efficient than electric f 1 GHz

5 Ferrite&rod&op4mized&probe& Classical&open&loop&"&resolu4on&limit&is& &loop& & SoluKon(:((add(a(ferrite(core(with(conical(shape! Concentrate(magneKc(field( " beier(resolukon( Many(loops(with(a(thicker( wire(is(possible (( " beier(efficiency(

6 Simula4on&of&ferrite&probes& Modeled& H(field(amplitude((A/m)( d(=(20(µm( d(=(50(µm( d(=(100(µm( d(=(200(µm( 0.5(mm( H(field(amplitude((A/ m)( 0.5(mm( 12(turns( 1(turn( 400(µm( 400(µm( Realized& Axis(X((mm)( Axis(X((mm)( H(field(vs(the(distance(to(the(Kp(d(and(vs(number(of(turns(N$ (Pulse(t R =3(ns,(t W =100(ns)( & 0( 1( 2( 3( 4( 5mm( Ferrite(rod(of(diameter(2(mm( (SpaKal(resoluKon( 400µm(close(to(the(Kp( (SpaKal(resoluKon(does(not(depend(on(N$

7 Dedicated&chips&for&probe&tes4ng& # Test(chip(designed(with(Freescale( 0.25(µm(SMARTMOS( Chip#1& 3mmx4.5m # Contains(various(interconnect( 50Ω( m& structures(with(high(frequency(on" lines( chip&voltage&sensors&(ocs)&to( measure(local(voltage(fluctuakons( induced(by(the(nearefield(injeckon( Buses( # Mounted(in(CQFP64(package(with(a( removable(metallic(lid(( DieEtoEdie(bonding(( between(buffers( DieEtoEdie( bonding( between((50ω( loads( OVS( PCB&control& card& Chip#2& 3mmx3mm& Power(rail( above(logic( blocks( Power(rails(above( power(grid(and( logic(blocks( Wide(power(rails( OVS( Power(rails(above( analog(blocks(

8 On"chip&EM&measurements& Targeted structure: set of 50Ω transmission lines with variable spacing Evaluate coupling between the probe and the lines (injection) Evaluate spurious coupling between the lines (injection) CW injection on 50Ω transmission lines f=1.4(ghz,(p RF (=(43(dBm( Scan(alKtude(=(400(µm,(Scan(step(=(50(µm( H Analog pad connected to V ref 50 Ω Line 0 µm 50 Ω 50 Ω 50 Ω 50 Ω Metal 2 connected to V ref Line µm Line 5.5 µm Line 10 µm Line30µm Line70µm On-chip sensors 50 Ω 50 Ω 50 Ω 50 Ω 50 Ω 50 Ω 50 Ω Line120µm 50 Ω 50 Ω Line320µm 50 Ω 50 Ω Bandgap V ref Structure 1! Struct µm # Voltage(coupled( on(struct1(lines(vs( probe(posikon(( # DisKnguish(two( lines(separated(by( more(than(100( µm(

9 On"chip&EM&measurements& Pulse injection on 50Ω transmission lines Ferrite probe, 5.5 turns, f=10mhz, t R =t F 10ns, t W =50ns, V PP =10V - - x x x x Measure Model Excellent behavior agreement True input pulse shape (overshoot) not accounted for Probe-sample model Equivalent circuit model extracted from S-parameters Coupling accounted by mutual inductance vs $ frequency $ distance

10 60&GHz&near"field&imagery& 60 GHz Gunn diode + isolator + 10 db coupler + Schottky detector 60GHz WR15 tuner Piezo actuator Plas4cs&and&ceramics&are&almost&transparent&to& mm"wave& $ InspecKon(of(ICs(through(the(package( $ IdenKficaKon(of(area(of(interest(for(future(EM( injeckon( Probe and its reflection

11 60&GHz&near"field&imagery& Package&IC&imaged&with&open&waveguide& &"&spakal(resolukon( 1(mm( die mm( mm( MetalizaKons(between(die(and( conneckng(pads( Spa4al&resolu4on&33&µm&i.e.&λ/150& We&are&able&to&inspect&through&the&package& Both&should&be&merged & s4ll&to&come&

12 Summary& Probes(:(design,(fabricaKon(&(characterizaKon( OpKmized(new(probes( Dedicated(test(chips( EM(coupling(experiments(&(models( mmewave(imagery( EM(aIacks(on(circuits( EM(pla_orm( EM(fault(injecKon(in(AES( BitEset(&(bitEreset( Fault(propagaKon(modeling(

13 New&EM&acack&pladorm& Technical(datasheet( 3(motorized(axes((stepsize(0.1(µm)( Faraday(cage(isolaKon( Flexible(probe(support(for(emirng( or(receiving(probes( Modified(smartcard(reader((accept( current(side(channel(aiack)( Oscilloscope(monitoring(and(PC( controlled( Suitable(for ( Mapping(in(EM(listening(mode( Pulse(injecKon((up(to(200V(peak)(

14 Problem&of&EM&acack&on&secure&ICs& 1. Enhance EM injection $ improve spatial resolution $ improve EM power transfer to IC Figure of merit of the probe Impedance matching 2. Enhance the capability of EM injection $ single-bit and multi-bit timing faults have been demonstrated $ it is not enough for smartcards 3. Enhance the protection of future ICs and smartcards $ simulate fault propagation at hardware level $ help to define countermeasures

15 Timing&faults&on&AES& Acack&with&ferrite&probes&and&posi4ve&or&nega4ve&square&pulses& $ PosiKve(pulses(are(more(efficient("(layout(dependent(?( $ Fault(probability(depends(on(clock(frequency("(Kming(faults( $ Compared(to(single(loop,(ferrite(probes(are(more(efficient(( strong(reduckon(of(pulse(intensity(needed(to(produce(the(fault( &EM&acack&enhanced&by&probe&op4miza4on&

16 Effects&of&EM&injec4on&on&secure&circuits& Moderate&intensity& Vdd& EM&coupling& Data( D1( Q1( D2( Q2( CK( CK1( LOGIC& Skew&δ&& Vdd/2& Vdd"Gnd& Gnd& EM&coupling& [CK1 > Q1] + [Q1 > D2] < T CK δ T SETUP2

17 Effects&of&EM&injec4on&on&secure&circuits& High&intensity& Vdd& EM&coupling& Inversion( Data( D1( Q1( D2( Q2( CK( CK1( LOGIC& Skew&δ&& Vdd"Gnd& Gnd& EM&coupling& Bit"set&or&bit"reset&!&

18 Effects&of&EM&injec4on&on&secure&circuits& Set (On = 1) Reset (On = 0) Data_IN DFF& 0&to&7& DFF& i+8&to&i+15& DFF& N"&7&to&N& Data_OUT CLK EM Injection CLK All bytes set to AA ( ) CLK stopped! Timing fault not allowed Read data in memory

19 Bit"set&and&bit"reset&on&secure&circuits& $ Deterministic errors $ EM injection is strongly localized

20 EM&faults&modeling& ( Embedded&fault&simula4on&& concept( Embbeded(funcKonality(which(is( able(to(interrupt(the(program( execukon(to(modify(the(context( (variables,(addresses,(registers,( program(counter,.)(( Results( Realized(Fault(Models:(InstrucKon( jump,(memory(modificakon( ApplicaKon(on(soQware( implementakon(:(vulnerabilikes( idenkcakon(

21 Conclusion& We(have(addressed(EM(aIacks(on(ICs:( ( $ EM(listening(of(ICs(is(wellEknown((not(invesKgated(here)( $ EM(observaKon(of(ICs( # New(setup(@(60GHz(proposed( $ EM(fault(injecKon( # Dedicated(opKmized(probes((ferrite,(mulKple(loops)( # In4situ(probe(characterizaKon(owing(to(dedicated(testchips( # QuanKtaKve(model(of(probeEcircuit(coupling( # Timing(faults(observed(on(AES,(efficiency(improved(with(new(probes( # BitEset(and(bitEreset(demonstrated(on(smartcards( # Embedded(EM(fault(modeling(tool( Expected(future(improvement(in(countermeasures(against(EM(aIacks(

22 Thank(you(!(