Electromagnetic fault injection (EMFI) has recently gained popularity as a mean to induce faults because of its inherent advantages. Despite this popularity, there is only a little information on how EMFI generates faults. Within this context, this article aims at filling this lack by proposing a complete understanding and modeling of EM induction on integrated circuits (ICs). The presented model is confronted to experiments to endorse its soundness.

Electromagnetic Fault Injection (EMFI) has recently gained popularity as a mean to induce faults because of its inherent advantages. Among them, the most interesting is probably its ability to generate faults in Systems on Chips without removing the package, and this even if only the frontside is exposed to the EM field. Despite this popularity, there is only little information on how EMFI generates faults. Within this context, this paper first aims at filling this lack by proposing a complete modeling of EM induction fault mechanism. In a second step, the introduced model is confronted to experimental data in order to demonstrate its soundness.

Bulk Built-In Current Sensors (BBICS) were developed to detect the transient bulk currents induced in the bulk of integrated circuits when hit by ionizing particles or pulsed laser. This paper reports the experimental evaluation of a complete BBICS architecture, designed to simultaneously monitor PMOS and NMOS transistors, under Photoelectric Laser Stimulation (PLS). The obtained results are the first experimental proof of the efficiency of BBICS in laser fault injection detection attempts. Furthermore, this paper highlights the importance of BBICS tapping in a sensitive area (logical gates) for improved laser detection. It studies the performances of this BBICS architecture and suggests modifications for its future implementation.

Lasers have become one of the most efficient means to attack secure integrated systems. Actual faults or errors induced in the system depend on many parameters, including the circuit technology and the laser characteristics. Understanding the physical effects is mandatory to correctly evaluate during the design flow the potential consequences of a laser-based attack and implement efficient counter-measures. This paper presents results obtained within the LIESSE project, aiming at defining a comprehensive approach for designers. Outcomes include the definition of fault/error models at several levels of abstraction, specific CAD tools using these models and new counter-measures well-suited to thwart laser-based attacks. Actual measures on components manufactured in the new 28 nm FDSOI technology are also presented.

Implementation attacks are a major threat to hardware cryptographic implementations. These attacks exploit the correlation existing between the computed data and variables such as computation time, consumed power, and electromagnetic (EM) emissions. Recently, the EM channel has been proven as an effective passive and active attack technique against secure implementations. In this paper, we resume the recent results obtained on this subject, with a particular focus on EM as a fault injection tool.

Fault attacks are widely deployed against secure devices by hardware evaluation centers. While the least expensive fault injection techniques, like clock or voltage glitches, are well taken into account in secure devices by dedicated hardware counter-measures, more advanced techniques, such as light based attacks, require huge investments. This paper presents a new way to induce faults at a moderate cost that may defeat already in place hardware counter-measures. To demonstrate its effectiveness we applied this technique on an ASIC component. For this demonstration, fault exploitation is operated using the classic Bell core attack applied on a modular exponentiation supported by a modular arithmetic co-processor.

The paper aims at demonstrating experimentally that the tiny Electro Magnetic (EM) coupling between the tip end of a micro-antenna is sufficient to locally and directly inject power into CMOS Integrated Circuits (IC). More precisely, experimental results show that such electrical couplings are sufficient to disturb, with and without removing the IC package, the behavior of 90nm CMOS Ring Oscillators, a representative structure of CMOS logic but also a constituting element of some True Random Number Generators (TRNGs) or clock generator.

Power management for contactless smartcards (SC) is mandatory since energy is supplied by RF electromagnetic waves. At any time and for any SC functional instruction, product engineers must ensure that the stored energy is able to satisfy system consumption. This paper proposes a methodology to survey dynamic current in contactless SC by charge variation analysis. Experimented on a real SC product, it is shown that simulation results are in good agreement with silicon measurements. Finally, we conclude this methodology may be used like a signoff step of product design flow.