Abstract:Voltage Fault Injection (VFI), also known as power glitching, has proven to be a severe threat to real-world systems. In VFI attacks, the adversary disturbs the power-supply of the target-device forcing the device to illegitimate behavior. Various countermeasures have been proposed to address different types of fault injection attacks at different abstraction layers, either requiring to modify the underlying hardware or software/firmware at the machine instruction level. Moreover, only recently, individual chip manufacturers have started to respond to this threat by integrating countermeasures in their products. Generally, these countermeasures aim at protecting against single fault injection (SFI) attacks, since Multiple Fault Injection (MFI) is believed to be challenging and sometimes even impractical. In this paper, we present {\mu}-Glitch, the first Voltage Fault Injection (VFI) platform which is capable of injecting multiple, coordinated voltage faults into a target device, requiring only a single trigger signal. We provide a novel flow for Multiple Voltage Fault Injection (MVFI) attacks to significantly reduce the search complexity for fault parameters, as the search space increases exponentially with each additional fault injection. We evaluate and showcase the effectiveness and practicality of our attack platform on four real-world chips, featuring TrustZone-M: The first two have interdependent backchecking mechanisms, while the second two have additionally integrated countermeasures against fault injection. Our evaluation revealed that {\mu}-Glitch can successfully inject four consecutive faults within an average time of one day. Finally, we discuss potential countermeasures to mitigate VFI attacks and additionally propose two novel attack scenarios for MVFI.

A Hierarchical Fault Injection System for RISC-V Processors Targeting Single Event Upsets in Flip-Flops

Analog Circuit Simulation Approach with Multi-Fault Injector

Electromagnetic fault injection against a System-on-Chip, toward new micro-architectural fault models

Non-intrusive study on FPGA of the SEU sensitivity on the COTS RISC-V VeeR EH1 soft processor from Western Digital

Simics-based System Level Fault Injection Platform

Fault Injection Attack Emulation Framework for Early Evaluation of IC Designs

A Flexible Soft Error Mitigation Framework Leveraging Dynamic Partial Reconfiguration Technology

A Micro Architectural Events Aware Real-Time Embedded System Fault Injector

A Cycle-Accurate Soft Error Vulnerability Analysis Framework for FPGA-based Designs

A Single Event Effect Simulation Method for RISC-V Processor

Using Formal Verification to Evaluate Single Event Upsets in a RISC-V Core

Study of Fault-Injection for FPGA Based Fault-Tolerant Computer

Hardware Versus Software Fault Injection of Modern Undervolted SRAMs

Study of an Automated Precise SEU Fault Injection Technique

Radioresistance Emulation of FPGA Based on Dynamic Partial Reconfiguration

A Deep Investigation on Stealthy DVFS Fault Injection Attacks at DNN Hardware Accelerators

Detect and Replace: Efficient Soft Error Protection of FPGA-Based CNN Accelerators

Electromagnetic fault injection: towards a fault model on a 32-bit microcontroller

Bypassing Isolated Execution on RISC-V using Side-Channel-Assisted Fault-Injection and Its Countermeasure

Oops..! I Glitched It Again! How to Multi-Glitch the Glitching-Protections on ARM TrustZone-M

Verification and Automatic Error Injection Method of SEM IP Core for SRAM-Based FPGAs