Study on Effect of ElectroMagnetic Fault Injection Attack on Dynamic Random Access Memory

Qiang LIU; Honghui TANG

doi:10.11999/JEIT210566

Volume 43 Issue 9

Sep. 2021

Turn off MathJax

Article Contents

Article Navigation > Journal of Electronics & Information Technology > 2021 > 43(9): 2449-2457

Qiang LIU, Honghui TANG. Study on Effect of ElectroMagnetic Fault Injection Attack on Dynamic Random Access Memory[J]. Journal of Electronics & Information Technology, 2021, 43(9): 2449-2457. doi: 10.11999/JEIT210566

Citation:

Qiang LIU, Honghui TANG. Study on Effect of ElectroMagnetic Fault Injection Attack on Dynamic Random Access Memory[J]. Journal of Electronics & Information Technology, 2021, 43(9): 2449-2457. doi: 10.11999/JEIT210566

Citation:

PDF( 4026 KB)

Study on Effect of ElectroMagnetic Fault Injection Attack on Dynamic Random Access Memory

doi: 10.11999/JEIT210566

Qiang LIU^,,
Honghui TANG

1.
School of Microelectronics, Tianjin University, Tianjin 300072, China
2.
Tianjin Key Laboratory of Imaging and Sensing Microelectronic Technology, Tianjin 300072, China

Funds: The National Natural Science Foundation of China (61974102)

Received Date: 2021-06-11
Rev Recd Date: 2021-08-15

Available Online: 2021-08-26

Publish Date: 2021-09-16

Abstract

Abstract

To investigate the effect of ElectroMagnetic Fault Injection (EMFI) attacks on the security of Dynamic Random Access Memory (DRAM), DRAMs are applied to an EMFI platform and are attacked with same attack settings firstly in this paper. Firstly, the attack results are collected and the faults are classified. Secondly, the mechanism of the faults occurred in the experiments are analyzed based on the fundamental structure of DRAM. Finally, the threats of the faults occurred in DRAM to the security of computer system are analyzed. In the experiments, multiple transient faults and multiple persistent faults are found. According to the experiments and analysis, it is found that the EMFI can inject persistent faults into the specified addresses of DRAM with low spatio-temporal resolution. In addition, persistent faults are successfully injected into S-box of AES-128 that stored in DRAM in this paper, and the key of AES is recovered by exploiting the faults. The experiment of key cracking indicates that EMFI attacks on DRAM pose serious security threats to computer systems, and the experiment indicates that researching on the security of DRAM is of great significance to hardware security.
- Hardware security,
- ElectroMagnetic Fault Injection (EMFI) attack,
- Dynamic Random Access Memory (DRAM)

FullText(HTML)

References(18)

References

[1]	MUTLU O. Memory scaling: A systems architecture perspective[C]. 2013 5th IEEE International Memory Workshop, Monterey, USA, 2013: 21–25.
[2]	DENNARD R H. Technical literature [Reprint of "field-effect transistor memory" (US Patent No. 3, 387, 286)][J]. IEEE Solid-State Circuits Society Newsletter, 2008, 13(1): 17–25. doi: 10.1109/N-SSC.2008.4785686
[3]	WALKER A J, LEE S, and BEERY D. On DRAM rowhammer and the physics of insecurity[J]. IEEE Transactions on Electron Devices, 2021, 68(4): 1400–1410. doi: 10.1109/TED.2021.3060362
[4]	GUO Xiaolong, ZHU Huifeng, JIN Yier, et al. When capacitors attack: Formal method driven design and detection of charge-domain trojans[C]. 2019 Design, Automation & Test in Europe Conference & Exhibition (DATE), Florence, Italy, 2019: 1727–1732.
[5]	姜会龙, 朱翔, 李悦, 等. 基于微控制器的AES激光注入攻击研究[J]. 电子与信息学报, 2021, 43(5): 1357–1364. doi: 10.11999/JEIT200163 JIANG Huilong, ZHU Xiang, LI Yue, et al. Research on laser injection attack for AES based on micro-controller unit[J]. Journal of Electronics &Information Technology, 2021, 43(5): 1357–1364. doi: 10.11999/JEIT200163
[6]	DEHBAOUI A, DUTERTRE J M, ROBISSON B, et al. Electromagnetic transient faults injection on a hardware and a software implementations of AES[C]. 2012 Workshop on Fault Diagnosis and Tolerance in Cryptography, Leuven, Belgium, 2012: 7–15.
[7]	ELMOHR M A, LIAO Haohao, and GEBOTYS C H. EM fault injection on ARM and RISC-V[C]. 2020 21st International Symposium on Quality Electronic Design (ISQED), Santa Clara, USA, 2020: 206–212.
[8]	MENU A, DUTERTRE J M, POTIN O, et al. Experimental analysis of the electromagnetic instruction skip fault model[C]. 2020 15th Design & Technology of Integrated Systems in Nanoscale Era (DTIS), Marrakech, Morocco, 2020: 1–7.
[9]	MORO N, DEHBAOUI A, HEYDEMANN K, et al. Electromagnetic fault injection: Towards a fault model on a 32-bit microcontroller[C]. 2013 Workshop on Fault Diagnosis and Tolerance in Cryptography, Los Alamitos, USA, 2013: 77–88.
[10]	CUI Ang and HOUSLEY R. BADFET: Defeating modern secure boot using second-order pulsed electromagnetic fault injection[C]. 11th USENIX Workshop on Offensive Technologies (WOOT 17), Vancouver, Canada, 2017.
[11]	BAYON P, BOSSUET L, AUBERT A, et al. Contactless electromagnetic active attack on ring oscillator based true random number generator[C]. The Third International Workshop, COSADE 2012, Darmstadt, Germany, 2012: 151–166.
[12]	ORDAS S, GUILLAUME-SAGE L, and MAURINE P. EM injection: Fault model and locality[C]. 2015 Workshop on Fault Diagnosis and Tolerance in Cryptography (FDTC), Saint-Malo, France, 2015: 3–13.
[13]	ZHANG Fan, ZHANG Yiran, JIANG Huilong, et al. Persistent fault attack in practice[J]. IACR Transactions on Cryptographic Hardware and Embedded Systems, 2020(2): 172–195. doi: 10.13154/tches.v2020.i2.172-195
[14]	LOHRKE H, TAJIK S, KRACHENFELS T, et al. Key extraction using thermal laser stimulation: A case study on Xilinx Ultrascale FPGAs[J]. IACR Transactions on Cryptographic Hardware and Embedded Systems, 2018(3): 573–595.
[15]	COLOMBIER B, MENU A, DUTERTRE J M, et al. Laser-induced single-bit faults in flash memory: Instructions corruption on a 32-bit microcontroller[C]. 2019 IEEE International Symposium on Hardware Oriented Security and Trust (HOST), McLean, USA, 2019: 1–10.
[16]	LIAO Haohao and GEBOTYS C. Methodology for EM fault injection: Charge-based fault model[C]. 2019 Design, Automation & Test in Europe Conference & Exhibition (DATE), Florence, Italy, 2019: 256–259.
[17]	DUMONT M, LISART M, and MAURINE P. Modeling and simulating electromagnetic fault injection[J]. IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, 2021, 40(4): 680–693. doi: 10.1109/TCAD.2020.3003287
[18]	MENU A, BHASIN S, DUTERTRE J M, et al. Precise spatio-temporal electromagnetic fault injections on data transfers[C]. 2019 Workshop on Fault Diagnosis and Tolerance in Cryptography (FDTC), Atlanta, USA, 2019: 1–8.