总线故障：新型总线故障攻击以破坏嵌入式系统中的可信执行环境.pdf

1、#BHASIA BlackHatEventsFaults In Our Bus:Faults In Our Bus:Novel Bus Fault Attacks toNovel Bus Fault Attacks toBreak ARM Break ARM TrustZoneTrustZoneNimish Mishra,Anirban Chakraborty,Debdeep MukhopadhyayIndian Institute of Technology Kharagpur,India#BHASIA BlackHatEventsWho are we?Who are we?Nimish M

2、ishraAnirban ChakrabortyDebdeep MukhopadhyayIndian Institute of Technology Kharagpur India#BHASIA BlackHatEvents1.What are Faults?2.Traditional Fault Points on Embedded Systems and SoCs3.A(new)Fault Point on SoCs4.OP-TEE?5.End-to-end Attack Load(adversarial)Trusted Application through Faults Redirec

3、t communication for other Trusted Applications Decrypt(redirected)communication6.ImpactOutlineOutline#BHASIA BlackHatEventsWhat are Faults?What are Faults?#BHASIA BlackHatEventsActively perturb data or control-flow of a system and gain information about the secret through faulty system responseInput

4、Correct OutputIncorrect Output#BHASIA BlackHatEventsFault causes error and error can be exploited to leak secret informationFault attack sometimes combined with side channel can lead to stronger attacksFault InjectionSide Channel Observation#BHASIA BlackHatEventsThe Fault Attack JungleProtocolsCrypt

5、ographic PrimitivesArithmeticRTL:ALU,REGs,MEMLogic:Gates,Flip-flopsTransistorsFault ExploitationFault InjectionI.Verbauwhede,D.Karaklajid,and J.-M.Schmidt,“The Fault Attack Jungle-AClassification Model to Guide You”,FDTC,2011Fault Attack on Embedded Systems#BHASIA BlackHatEventsFault Attack Vectors

6、WHAT:Strategically modify execution environment of a system HOW:Through changes in external operational conditionsFig:Electromagnetic Fault Injection(EMFI)ProbeFig:Working principle of EMFI Probe#BHASIA BlackHatEventsFI Attack Vectors WHAT:Strategically modify execution environment of a system HOW:T