Body Biasing Injection (BBI) is a fault injection method involving applying a voltage pulse onto the backside substrate of integrated circuits using a conductive needle. Some studies have been focusing on the characterization of BBI effects, but no fault model explaining the origin of the induced faults has yet been established. The repeatability of this method has been demonstrated, and electrical models have been proposed. However, up to the best of our knowledge, no successful differential fault attack using BBI and single bit fault model on hardware coprocessors has yet been reported in the literature. Within this context, this work presents enhanced practices to perform BBI in an even more reproducible and reliable way compared to previous works. It also brings insights on how and why faults occur under BBI and presents a fault attack performed on a hardware AES coprocessor embedded in a modern 32-bits microcontroller.

Body Biasing Injection (BBI) is one of the most recent fault injection techniques. It consists of applying voltage pulses onto the substrate of integrated circuits (ICs) using a sharp needle. Because this technique is more recent, there is little information about the nature of the injected disturbances in the ICs. It is especially true if one considers that the substrate of microcontrollers can either be of dual or triple-well types, and thus can have different susceptibility to BBI. In previous work, a study of the effects of thinning the substrate of ICs on BBI and an electrical model were proposed. However, this study was only conducted for dual-well ICs. As a result, this paper provides enhanced electrical models to simulate the distribution of BBI disturbances through the different substrates, and it also gives a global view of the different BBI induced effects in relation to the nature of the substrate and the polarity of the injected voltage pulses.

Electromagnetic fault injection (EMFI), which is a quite recent fault injection technique compared to laser fault injection, has gained in popularity these last years. Its increasing popularity can be probably explained by its inherent advantages among which the limited required preparation of devices can be viewed as the main one. The principle of EMFI consists in generating a powerful EM pulse in the close vicinity of ICs. To that aim a voltage pulse generator is used to induce a sudden current variation in probes, i.e. coils made of several wire turns around a ferrite core. However, EMFI is considered a fault injection technique with a poor spatial resolution mainly because EMFI probes are quite large. Increasing the spatial resolution of EMFI could be achieved by reducing the dimensions of probes. However, such a task is difficult and implies using more powerful voltage generators. Among the challenges to be addressed to enhance the spatial resolution of probes, one of the first ones is to determine how should be scaled the voltage pulse generators with the scaling of probe dimensions. This paper addresses this question from theoretical and practical points of view.