Adjusting Laser Injections for Fully Controlled Faults

Hardware characterizations of integrated circuits have been evolving rapidly with the advent of more precise, sophisticated and cost-efficient tools. In this paper we describe how the fine tuning of a laser source has been used to characterize, set and reset the state of registers in a 90 nm chip. By adjusting the incident laser beam’s location, it is possible to choose to switch any register value from ‘ 0 ’ to ‘ 1 ’ or vice-versa by targeting the PMOS side or the NMOS side. Plus, we show how to clear a register by selecting a laser beam’s power. With the help of imaging techniques, we are able to explain the underlying phenomenon and provide a direct link between the laser mapping and the physical gate structure. Thus, we correlate the localization of laser fault injections with implementations of the PMOS and NMOS areas in the silicon substrate. This illustrates to what extent laser beams can be used to monitor the bits stored within registers, with adverse consequences in terms of security evaluation of integrated circuits

Physical instrumental vetoes for gravitational-wave burst triggers

We present a robust strategy to \emph{veto} certain classes of instrumental glitches that appear at the output of interferometric gravitational-wave (GW) detectors.This veto method is `physical' in the sense that, in order to veto a burst trigger, we make use of our knowledge of the coupling of different detector subsystems to the main detector output. The main idea behind this method is that the noise in an instrumental channel X can be \emph{transferred} to the detector output (channel H) using the \emph{transfer function} from X to H, provided the noise coupling is \emph{linear} and the transfer function is \emph{unique}. If a non-stationarity in channel H is causally related to one in channel X, the two have to be consistent with the transfer function. We formulate two methods for testing the consistency between the burst triggers in channel X and channel H. One method makes use of the \emph{null-stream} constructed from channel H and the \emph{transferred} channel X, and the second involves cross-correlating the two. We demonstrate the efficiency of the veto by `injecting' instrumental glitches in the hardware of the GEO 600 detector. The \emph{veto safety} is demonstrated by performing GW-like hardware injections. We also show an example application of this method using 5 days of data from the fifth science run of GEO 600. The method is found to have very high veto efficiency with a very low accidental veto rate.Comment: Minor changes, To appear in Phys. Rev.

On Analyzing Program Behavior Under Fault Injection Attacks

Fault attacks pose a serious threat to cryptographic algorithm implementations. It is a non-trivial task to design a code that minimizes the risk of exploiting the incorrect output that was produced by inducing faults in the algorithm execution process. In this paper we propose a design of an instruction set simulator capable of analyzing the code behavior under fault attack conditions. Our simulator is easy to use and provides a valuable insights for the designers that could help to harden the code they implement

DFA on LS-Designs with a Practical Implementation on SCREAM (extended version)

LS-Designs are a family of SPN-based block ciphers whose linear layer is based on the so-called interleaved construction. They will be dedicated to low-end devices with high performance and low-resource constraints, objects which need to be resistant to physical attacks. In this paper we describe a complete Differential Fault Analysis against LS-Designs and also on other families of SPN-based block ciphers. First we explain how fault attacks can be used against their implementations depending on fault models. Then, we validate the DFA in a practical example on a hardware implementation of SCREAM running on an FPGA. The faults have been injected using electromagnetic pulses during the execution of SCREAM and the faulty ciphertexts have been used to recover the key’s bits. Finally, we discuss some countermeasures that could be used to thwart such attacks

Theoretical and experimental investigation of a CDI injection system operating on neat rapeseed oil - feasibility and operational studies

This thesis presents the work done within the PhD research project focusing on the utilisation of plant oils in Common Rail (CR) diesel engines. The work scope included fundamental experimental studies of rapeseed oil (RSO) in comparison to diesel fuel, the feasibility analysis of diesel substitution with various plant oils, the definition and implementation of modifications of a common rail injection system and future work recommendations of possible changes to the injection system. It was recognised that neat plant oils can be considered as an alternative substitute for diesel fuel offering a natural way to balance the CO2 emissions. However, due to the differences between diesel and plant oils, such as density, viscosity and surface tension, the direct application of plant oils in common rail diesel engines could cause degradation of the injection process and in turn adversely affect the diesel engine’s performance. RSO was chosen to perform the spray characterisation studies at various injection pressures and oil temperatures under conditions similar to the operation of the common rail engine. High speed camera, Phase Doppler Anemometry and Malvern laser techniques were used to study spray penetration length and cone angle of RSO in comparison to diesel. To study the internal flow inside the CR injector the acoustic emission technique was applied. It was found that for oil temperatures below 40°C the RSO viscosity, density and surface tension are higher in comparison to diesel, therefore at injection pressures around 37.50 MPa the RSO spray is not fully developed. The spray penetration and cone angle at these spray conditions exhibit significant spray deterioration. In addition to the lab experiments, KIVA code simulated RSO sprays under CR conditions. The KH-RT and RD breakup models were successfully applied to simulate the non-evaporating sprays corresponding to the experimental spray tests and finally to predict i real in-cylinder injection conditions. Numerical results showed acceptable agreement with the experimental data of RSO penetration. Based on experimental and numerical results it was concluded that elevated temperature and injection pressure could be the efficient measures to overcome operational obstacles when using RSO in the CR diesel engine. A series of modifications of low- and highpressure loops was performed and experimentally assessed throughout the engine tests. The results revealed that the modifications allowed to run the engine at the power and emission outputs very close to diesel operation. However, more fundamental changes were suggested as future work to ensure efficient and trouble-free long-term operation. It is believed that these changed should be applied to meet Euro IV and V requirements

Preclinical stroke research - advantages and disadvantages of the most common rodent models of focal ischaemia

This review describes the most commonly used rodent models and outcome measures in preclinical stroke research and discusses their strengths and limitations. Most models involve permanent or transient middle cerebral artery occlusion with therapeutic agents tested for their ability to reduce stroke-induced infarcts and improve neurological deficits. Many drugs have demonstrated preclinical efficacy but, other than thrombolytics, which restore blood flow, none have demonstrated efficacy in clinical trials. This failure to translate efficacy from bench to bedside is discussed alongside achievable steps to improve the ability of preclinical research to predict clinical efficacy: (i) Improvements in study quality and reporting. Study design must include randomization, blinding and predefined inclusion/exclusion criteria, and journal editors have the power to ensure statements on these and mortality data are included in preclinical publications. (ii) Negative and neutral studies must be published to enable preclinical meta-analyses and systematic reviews to more accurately predict drug efficacy in man. (iii) Preclinical groups should work within networks and agree on standardized procedures for assessing final infarct and functional outcome. This will improve research quality, timeliness and translational capacity. (iv) Greater uptake and improvements in non-invasive diagnostic imaging to detect and study potentially salvageable penumbral tissue, the target for acute neuroprotection. Drug effects on penumbra lifespan studied serially, followed by assessment of behavioural outcome and infarct within in the same animal group, will increase the power to detect drug efficacy preclinically. Similar progress in detecting drug efficacy clinically will follow from patient recruitment into acute stroke trials based on evidence of remaining penumbra