EMFI: Electro-Magnetic Fault Injection
About
A test bench dedicated to security characterization through electromagnetic fault injection on integrated circuits.
Description
Electromagnetic fault injection (EMFI) tests play a crucial role in the security evaluation of integrated circuits and electronic systems. These tests simulate fault attacks by deliberately inducing errors in the normal operation of electronic devices to identify potential vulnerabilities that could be exploited by attackers to bypass security mechanisms, extract confidential data, or compromise the system’s integrity. By reproducing these attack scenarios in a controlled environment, designers and testers can better understand how to enhance the resilience of their products against such threats, thereby contributing to the development of safer and more reliable technologies in a world increasingly reliant on electronics for critical applications.
The test bench is equipped with a pulse injector and an automated XY positioning table, featuring precise control parameters. The control scripts on the PC associated with the test bench allow the user to conduct test campaigns by simultaneously controlling the injector, the table, the oscilloscope, and the circuit under test. Several injection antennas, designed in our laboratory, are made available. The pulse injector also offers the possibility to conduct “glitch” type attacks on the power supply.
Technical specifications:
This bench currently consists of:
A high-voltage pulse generator (AVTECH AVRK-4-B-PN-VXI-AC02)
Probes for EM injection (with variable characteristics)
A 2D positioning bench (XY axes) from Newport with motors and an associated controller for each axis (resolution in the range of 0.1 to 1 μm)
A 4 GHz 8-bit oscilloscope + cables and 500 MHz probes
An RF signal amplifier (Preamp P303 30 dB/3 GHz)
Antennas for “Side-Channel” analysis (Langer’s RF2 Set, with 4 antennas of different geometries and sensitivities up to 3 GHz)
Electromagnetic Pulse Characteristics (AVTECH AVRK-4-B-PN-VXI-AC02):
Amplitude: 120 – 800 V
Pulse width, measured at: ≤ 5 ns
Rise time (20%-80%): ≤ 1.5 ns
Fall time (80%-20%): ≤ 3 ns
PRF: 0 to 10 kHz
Required load: 50Ω
Polarity: Positive or negative or both
GPIB & RS-232 control: Standard
Propagation delay: ≤ 50 ns (Ext trig in to pulse out)
Jitter: ± 100 ps (Ext trig in to pulse out)
More info available online at: www.avtechpulse.com/manuals/AVG-4B2-B%2Ced5.pdf
Case study:
This test bench enables the characterization of integrated circuits’ robustness against electromagnetic wave injection attacks. Secure systems should not exhibit any vulnerabilities to such attacks. Appropriate countermeasures must be integrated into these circuits or systems.
Access Provider / Facilities
