Hardware Security in Chip Hardening
An interactive exploration of fault injection attacks and hardware countermeasures.
Understanding Clock Glitch Attacks
This section explores how attackers introduce precise, short-lived faults (glitches) into a chip's clock signal. These disruptions can cause instructions to be skipped or corrupted, potentially bypassing security checks. Below, you can visualize this attack and then explore common defense mechanisms.
Attack Vector: Clock Signal Manipulation
A normal clock signal provides a stable heartbeat for the chip. A 'glitch' is a momentary pulse that is much shorter than a normal clock cycle. If timed correctly, it can trick a processor into misinterpreting its instructions.
Defense Mechanisms Comparison
Select a technique
Click on a bar in the chart to learn more about a specific hardening technique.
Understanding Reset Injection Attacks
Reset signals are critical for bringing a system to a known, secure state. Attackers can manipulate this signal, for example by inducing a very short reset pulse, to prevent security initializations from completing. This section demonstrates the attack and compares protective circuits.
Attack Vector: Power-On Reset Manipulation
A proper Power-On Reset (POR) requires voltage to be stable for a minimum duration to ensure all components initialize correctly. An attacker can create a short power dip to trigger an incomplete reset, leaving the system in a vulnerable state.
Defense Mechanisms Comparison
| Technique | Detection Speed | Immunity Level |
|---|
Different circuits can monitor system voltage and reset lines. They vary in how quickly they react and how well they distinguish malicious events from normal fluctuations.
Understanding Physical Tamper Protection
Tampering involves direct physical interaction with the chip, such as de-packaging it to probe internal signals or exposing it to light to disrupt memory cells. This section visualizes the physical layers of a chip and explores the sensors used to detect such invasive attacks.
Concept: Layered Physical Defenses
Modern chips are protected by multiple physical layers. The outermost layer might be an active mesh of wires that detects any break, while internal layers contain sensors for light, temperature, or radiation that indicate the chip's package has been breached.
Sensor Types & Relative Cost
Active Mesh
A grid of wires on the chip's surface. If any wire is cut (e.g., by drilling), the circuit is broken, triggering an alarm. High coverage but can have significant area overhead.
Light Sensors
Detects ambient light, which should not reach the silicon die. Effective against de-packaging attacks. Low power but can be fooled by focused ion beams.
Temp/Radiation Sensors
Monitors for abnormal operating temperatures or radiation levels, which can indicate attempts at invasive probing or fault injection. Protects against a wide range of physical attacks.
No comments:
Post a Comment