Fault-induced vulnerabilities have been studied in various aspects. While traditional fault injection techniques easily detect system-level vulnerabilities like buffer overflows, fault executions can introduce subtle potential vulnerabilities that may not trigger any system-level observable behaviors. These are particularly dangerous in cryptography. Using advanced cryptanalysis methods, these vulnerabilities, such as producing faulty ciphertexts, have been successfully exploited and are regarded as great threats to the security of real-world cryptography. In this way, there is a pressing need to study this very area. Our paper generally explores the internals of the fault-induced data-level vulnerabilities, which are subtle vulnerabilities resulting from faults that may not cause system crashes or overt errors but can expose sensitive information or weaken cryptographic primitives under specific cryptanalytic techniques, in cryptographic libraries. We propose a novel framework which can systematically analyze the vulnerabilities in cryptographic libraries under different fault models. By employing this method, we identified numerous critical fault locations that could undermine the security of cryptographic systems across a broad spectrum of libraries, fault models, and platforms. Furthermore, we provide a comprehensive analysis of select case studies, and engage in detailed discussions about the strategies to alleviate such vulnerabilities.

For embedded devices, the uncertainty of target physical environments is always a great challenge. With constrained resources and common overloaded uses, they can be more exposed to hardware faults. Other than stability and ordinary security issues, there exist some subtle phenomenons that lead to potential cryptanalysis or secret leakage. In this paper, we present STALKER, a framework to analyze the fragility of libraries under hardware fault models. Compared with existing tools, our framework targets faulty execution outputs, and can flexibly work on different libraries, architectures and support different search schemes. We find dozens of security-sensitive bits that may cause critical issues and provide detailed analysis.

Mobile edge computing (MEC) has become a new computing paradigm, which has caused new challenges, including how to dynamically place services to maintain user-perceived delays and determine the number of simultaneous executions of partitionable applications to optimize the quality of experience (QoE). What's more, the battery energy level of mobile devices and the operating cost of the service provider will also increase the difficulty of improving service performance. In order to solve the contradiction between the above factors and service performance, we study the performance optimization of mobile edge service placement for partitionable applications under the constraints of long-term cost budget and battery energy level. A centralized online service placement algorithm (COSPA) based on Lyapunov optimization is proposed, and the performance boundary of COSPA is theoretically analyzed. By stabilizing the average migration cost and the battery energy of the mobile device near a constant, the COSPA algorithm can obtain an asymptotically optimal solution. The experimental results based on the real dataset imply that the COSPA algorithm can obtain higher performance gains compared with the benchmarks and the Distributed Algorithm (DA).

Persistent fault analysis (PFA) is a newly proposed cryptanalysis for block ciphers. Although the injected fault is persistent during the entire encryption, the corresponding analysis is only applied to the last round in the original PFA. In this article, the enhanced PFA (EPFA) is proposed, which can push the limit of PFA by exploiting the fault leakage in deeper rounds and target to reduce the number of required ciphertexts as small as possible. EPFA is first introduced as a general method with a specific application to advanced encryption standard (AES). Then it is extended to other substitution–permutation network (SPN)-based block ciphers, such as LED and SKINNY, both of which have unique features that EPFA fits well. To improve the efficiency of EPFA, a parallel algorithm based on mixed radix numbers is developed, which fully utilizes the power of GPU. Our experimental results show that EPFA can reduce the number of required ciphertexts to be under 1000, which is only about 40% of the 2500 ciphertexts in previous PFA on AES. In contrast to the single-threaded implementation, the parallel EPFA can have a speedup roughly about 200 times.

In this paper, we raise practical situations in profiling based power analysis when profiling and target devices are quite different at several levels. "Crossed devices" are newly termed, including homogeneous and heterogeneous devices, which have not been carefully investigated. We identify such device variations and take a further step towards leveraging the deep learning based power analysis. Traditional template attacks and straight-forward deep learning based power analysis will fail, when the gap across devices is significantly enlarged. In this paper, we propose a noval frequency and learning based power analysis machanism, which is able to explore new attacking power of deep learning and address challenges caused by device variations. For the first time, power traces collected from our own PIC devices can be utilized to successfully attack the public dataset in DPAContest v4 which is based on a totally different AVR microcontroller.