Optima-SEC™: IC Security Analysis

Security is becoming a necessary aspect of semiconductor development, requiring complex, specialized verification. It is very hard to achieve with today’s technology and tools. As the IC (Integrated Circuit) is becoming the immutable root of trust, a device used everywhere to protect important information. The secret information stored can be a unique id of the chip to stop counterfeits or a password or user access information. These security assets need to be protected from notorious hackers who can extract the stored secret information by way of side-channel attacks, and fault injection attacks. Optima-SEC™, is the next-generation advanced fault simulation technology, targeting common, notorious security vulnerabilities and attack simulation, with a highly automated approach that provides a rapid and high-quality solution.

Introducing Optima-SEC™

Today most of the security verification is dome post-silicon, which is very expensive and late in the design cycle for any correction in case of any vulnerability found at that stage. Verification is done post-silicon partly because none of the EDA technologies available effectively verify security vulnerabilities and do fault attack simulation the at RTL level. Optima introduces Optima-SEC™ based on the patented FIE (Fault Injection Engine) technology, with orders of magnitude faster fault-simulation, combined with specialized smart algorithms that perform multiple bit-flips in a random fashion imitating hacker attack, to verify security vulnerabilities and perform FAS: Fault Attack Simulation.

Security verification at the RTL level can be accomplished within a reasonable schedule with Optima-SEC™, a task not possible using existing EDA tools. Optima-SEC™ consists of three main engines:

• SIFA – Security Information Flow Analysis Engine
• HTD – Hardware Trojan Detection Engine
• FAS – Fault Attack Simulation Engine

FAS Engine gets information, from SIFA and HTD engines regarding vulnerable portions of the design, Suspicious Trojan Insertion points, to generate and simulation  fault Injection Attacks.

Using Optima-SEC™, verification engineers not only verify their security measures, but can also discover vulnerabilities in those mechanisms.

Optima-SEC™ Specification

Optima-SEC™ can be useful in Automotive, Smart Cards, Aerospace, Industrial and other security-critical segments and is applied for:

• Fault-injection side-channel attack verification using FAS (Fault Attack Simulation)
• Detecting vulnerabilities and verification of security protection
• Assessing and improving security protection

FAS: Fault-Attack Simulation

One method of attack that has achieved notoriety that uses fault injection to disrupt normal device behavior in such a way that it corrupts the operation of security safe-guards to access key data, control structures, keys or other secure assets. Once this is done, usually at the hackers’ labs, the device is compromised, and hackers may be able to use the information  they discovered to attack similar devices within the applications they are targeting. The algorithms like, DFA is very well established to analyse the faulty output and guess the keys. Countermeasures have to planned against such fault attacks and its very important to verify these countermeasures right from the RTL level so that all the DFA proposed attacks are simulated using Optima-SEC™.

Faults may be injected into a device during a “sensitive” period of time (such as the boot process) to trigger the appropriate disruption. They could be introduced using: (1) voltage glitching on the power rails, (2) tempering with clock pins, (3) supplying an electro-magnetic pulse, (4) laser glitching, and other methods [3]. If a particular time period for a vulnerable function, such as a UDS communication window, is known then faults may be injected at a variety of moments during this period until an opening is triggered.

Some of the Fault injection attacks that can be used along with Differential Fault Analysis are:

• Attack to flip a single bit at the first round of AES-128 block cipher. Though this attack is proven to be practically impossible, post-silicon attack verification is difficult. If a countermeasure is planned to protect from these, FAS modelling can be used to verify at the RTL level
• Attacks a single bit at the 9^th round input of AES-128. FAS can model this using a simple single command. Once simulated propagation of the fault through each round block can be observed by Optima-SEC™ provided debug reports. These intermediate attack propagation reports help to design robust countermeasures at each round.

• Laser Attack. FAS can model laser attacks considering various parameters

• • ⮞ Attack Origin
  • ⮞ Radius of the attack
  • ⮞ Laser Intensity, more power more gates influenced
    • Degradation of Laser energy from the center of exposure to the outside of the illuminated circle
  • ⮞ Duration of the laser attack exposure
  • ⮞ PAG: Potentially attackable gates: Optima-SEC™ algorithm automatically calculates based on the attack origin on the design. An example below, three different laser beams are focussed on the AES engine layout at various times of the IC functioning.

R7_Logic: A Laser beam of larger radius is focussed on Round 7 logic of AES-128 Engine and FAS can be generated on various combination on the PAG, computed by Optima-SEC™. This laser beam is focussed at the time of Round 7 execution.

R8_Logic: A Laser beam of medium radius is focussed on Round 8 logic of AES-128 Engine and FAS can be generated on various combination on the PAG, computed by Optima-SEC™. This laser beam is focussed at the time of Round 8 execution, as the laser beam’s radius is not large, only parts of Round 8 will be marked as PAG.

R9_Logic: A Laser beam of smaller radius is focussed on Round 9 logic of AES-128 Engine and FAS can be generated on various combination on the PAG, computed by Optima-SEC™. This laser beam is focussed at the time of Round 9 execution, as the laser beam radius is not large, only small parts of Round 9 will be marked as PAG.

Discover other products from Optima HERE.