Experimental Analysis of the Laser-Induced Instruction Skip Fault Model

International audienceMicrocontrollers storing valuable data or using security functions are vulnerable to fault injection attacks. Among the various types of faults, instruction skips induced at runtime proved to be effective against identification routines or encryption algorithms. Several research works assessed a fault model that consists in a single instruction skip, i.e. the ability to prevent one chosen instruction in a program from being executed. This assessment is used to design countermeasures able to withstand a single instruction skip. We question this fault model on experimental basis and report the possibility to induce with a laser an arbitrary number of instruction skips. This ability to erase entire sections of a firmware has strong implications regarding the design of counter- measures

How Practical are Fault Injection Attacks, Really?

Fault injection attacks (FIA) are a class of active physical attacks, mostly used for malicious purposes such as extraction of cryptographic keys, privilege escalation, attacks on neural network implementations. There are many techniques that can be used to cause the faults in integrated circuits, many of them coming from the area of failure analysis. In this paper we tackle the topic of practicality of FIA. We analyze the most commonly used techniques that can be found in the literature, such as voltage/clock glitching, electromagnetic pulses, lasers, and Rowhammer attacks. To summarize, FIA can be mounted on most commonly used architectures from ARM, Intel, AMD, by utilizing injection devices that are often below the thousand dollar mark. Therefore, we believe these attacks can be considered practical in many scenarios, especially when the attacker can physically access the target device

Surface guided radiotherapy

Modern radiotherapy aims to treat the decease while minimizing the radiation dose to the adjacent normal tissue, to minimize acute and late effects of the treatment. The foremost technological approaches have been intensity modulated radiotherapy (IMRT) and intensity modulated proton therapy (IMPT) in combination with image guided radiotherapy (IGRT). IMRT and IMPT is characterized by a more conform dose distribution, often accompanied by steep dose gradients. In turn, accurate patient localization and motion management becomes more important. Several image guidance systems are available for radiotherapy (RT), with 3-dimensional (3D) volumetric images with cone beam computed tomography (CBCT) as a gold standard. In recent years, surface imaging (SI) using an optical surface scanning system has been included in the IGRT toolbox. The SI system CatalystTM (C-rad Positioning AB, Uppsala Sweden) visualize 3D surface images of the patient topography, and direct correlate the patient localization to the initial planned position. SI offers the largest field-of-view in RT, does not contribute to radiation exposure, provides real-time feedback and sub-millimeter spatial resolution. These characteristics are suitable for both patient positioning and motion management during RT.Integration with the linac provides beam control and automatic couch shifts, which imposes rigorous attention to quality assurance (QA) of the SI systems. In order to integrate the beam control, beam latency times (beam-on and beam-off) should be characterized, which required the development PIN diode circuit as a QA tool. Of extra importance was the measurements of the beam-off latency time, since it represents the time the linac continues to irradiate after the beam hold signal was sent from the SI system. The automatic couch shift is calculated by a deformable image registration (DIR) algorithm, unique for the CatalystTM surface scanning system. Positioning accuracy is dependent on the image registration, and hence, a deformable thorax phantom was developed to investigate accuracy of the DIR with anatomical realistic deformations present as a QA tool.Compared to traditional 3-point localization for patient positioning, this thesis has shown that SI improve the positioning for both breast and prostate cancer patients. Also, the SI workflow has shown to be time efficient for positioning of prostate cancer patients. A respiratory motion management technique is deep inspiration breath hold (DIBH), where the patient is instructed to hold his/her breath during the treatment delivery. The aim using DIBH, is to create an anatomical distance between the treatment volume and surrounding organs-at-risk (OARs). Comparative treatment planning studies, within the work of this thesis, showed that DIBH can be an effective method for both left sided breast cancer and Hodgkin’s lymphoma (HL) in order to spare dose to the heart. For HL, the combination of IMPT and DIBH was found to spare dose to OARs, however, due to the spread in target localization individual deviations from this treatment technique were observed. The real-time feedback from the surface image system was used to investigate the reproducibility of the DIBH to ensure correct dose distribution during the treatment delivery. High reproducibility of the isocenter position during DIBH was observed, however, for a few breath holds larger deviations occurred which urges the need to use beam control tolerance for the isocenter. The overall conclusion is that optical imaging systems, developed within the work of this thesis, can be used as an imaging tool for accurate and faster patient setup, intrafractional motion monitoring and reduced dose to OARs during treatment in DIBH

Material modifications due to nonlinear effects created by multiphoton absorption in single crystalline silicon

Material modification inside its bulk via high powered lasers involves much more than just heat transfer and melting of materials. It entails with it complex nonlinear physical phenomena such as multiphoton absorption, self-phase modulation, and self-focussing, amongst many others. These phenomena occur only with ultrafast lasers at very high intensities. Realising subsurface or bulk modifications in semiconductors such as silicon, opens up new avenues in the fields of optoelectronics and optical computation with the potential of increasing current computational speeds by orders of magnitude. The technology of three dimensional volume modification in materials via ultrafast lasers and nonlinear physics, is however, still in its nascent stages. This work explores the possibility of realising bulk modification in silicon and other polymers, and as well as their integration with optoelectronic devices; thus paving way for the future of optical computation

Low-cost electronic sensors for environmental research: pitfalls and opportunities

Repeat observations underpin our understanding of environmental processes, but financial constraints often limit scientists’ ability to deploy dense networks of conventional commercial instrumentation. Rapid growth in the Internet-Of-Things (IoT) and the maker movement is paving the way for low-cost electronic sensors to transform global environmental monitoring. Accessible and inexpensive sensor construction is also fostering exciting opportunities for citizen science and participatory research. Drawing on 6 years of developmental work with Arduino-based open-source hardware and software, extensive laboratory and field testing, and incor- poration of such technology into active research programmes, we outline a series of successes, failures and lessons learned in designing and deploying environmental sensors. Six case studies are presented: a water table depth probe, air and water quality sensors, multi-parameter weather stations, a time-sequencing lake sediment trap, and a sonic anemometer for monitoring sand transport. Schematics, code and purchasing guidance to reproduce our sensors are described in the paper, with detailed build instructions hosted on our King’s College London Geography Environmental Sensors Github repository and the FreeStation project website. We show in each case study that manual design and construction can produce research-grade scientific instrumentation (mean bias error for calibrated sensors –0.04 to 23%) for a fraction of the conventional cost, provided rigorous, sensor-specific calibration and field testing is conducted. In sharing our collective experiences with build-it- yourself environmental monitoring, we intend for this paper to act as a catalyst for physical geographers and the wider environmental science community to begin incorporating low-cost sensor development into their research activities. The capacity to deploy denser sensor networks should ultimately lead to superior envi- ronmental monitoring at the local to global scales

Biomimicry of Volatile-Based Microbial Control for Mitigating Fungal Pathogenicity

Volatile organic compounds (VOCs) are organic chemicals typically characterized as having low molecular weight, low solubility in water, and high vapor pressure. Consequently, they readily evaporate from liquid to the gaseous phase at standard temperature and pressure. VOCs are produced by many microorganisms as a result of both uninduced and induced metabolic pathways. Volatile-based microbial inhibition in environments such as soil is well founded, with numerous antimicrobial VOCs and formulations having been identified. Inhibitory VOCs are of particular interest as microbial control agents, as low concentrations of gaseous VOCs have been observed to elicit significant antimicrobial effects. It is believed that this contact-independent antagonism may present unique advantages over traditional microbial control methods, particularly where contact-dependent treatment methods are either impractical or inconvenient. This method may be of particular benefit for managing infections where disease may become pervasive in the population, such as with white-nose syndrome (WNS) among bats. A list of potential antifungal compounds and formulations was compiled by referencing the scientific literature. Screening of compounds and formulations was conducted through toxicity analyses and antimicrobial susceptibility testing for the in vitro ability of VOCs and formulations to inhibit growth of select pathogenic fungi. A dispersal system was developed that entailed electrical circuit and software engineering as well as quantitative analysis to validate consistent and accurate dispersal of potential treatment compounds and formulations. Successful completion of these goals culminated in exposure trials involving live bats to determine any significant toxicological effects. Ex and in situ treatment trials were conducted to determine efficacy of promoting the reduction of disease severity and increasing survivorship of infected bat populations. The identification of volatile-based inhibitory compounds, in conjunction with a novel method for accurate and automated delivery, could prove a promising treatment and prophylactic in combatting microbial pathogenesis and contamination

Design of an acoustically transparent pressure sensor for breast elastography

Breast cancer is the most commonly occurring cancer in women. Only in 2018 there were over 2 million new cases all over the world. The MURAB project, pursued at the University of Twente, has the aim to improving the breast biopsy procedure by reducing costs, patient discomfort and false negative rates. A 7-DOF KUKA robot arm steers an ultrasound transducer along a precise scanning trajectory to gather 3D volume image and stiffness values of the breast. Elasticity is the property of a body to be deformed and differs between tumors tissue and soft tissue. Elastography is a non-invasive technique in which the elasticity of a tissue is determined. The aim of this study is to design an acoustically transparent pressure sensor, mounted on the tip of the ultrasound probe, that can measure pressure differences across its surface during the scan, and assess elastographic measurements. The main idea is to use a pad of a characterized material and sequentially ultrasound images able to visualize the section of the pad and evaluate its deformation during time. The transmission of ultrasound waves into a solid depends on the mechanical characteristics of the material and on its physic state. In this work the relations between the acoustic properties and the mechanical behavior of an acoustically transparent pad are studied and evaluated

Dynamic Laser Fault Injection Aided by Quiescent Photon Emissions in Embedded Microcontrollers: Apparatus, Methodology and Attacks

Internet of Things (IoT) is becoming more integrated in our daily life with the increasing number of embedded electronic devices interacting together. These electronic devices are often controlled by a Micro-Controller Unit (MCU). As an example, it is estimated that today’s well-equipped automobile uses more than 50 MCUs. Some MCUs contain cryptographic co-processors to enhance the security of the exchanged and stored data with a common belief that the data is secured and safe. However many MCUs have been shown to be vulnerable to Fault Injection (FI) attacks. These attacks can reveal shared secrets, firmware, and other confidential information. In addition, this extracted information obtained by attacks can lead to identification of new vulnerabilities which may scale to attacks on many devices. In general, FI on MCUs corrupt data or corrupt instructions. Although it is assumed that only authorized personnel with access to cryptographic secrets will gain access to confidential information in MCUs, attackers in specialized labs nowadays may have access to high-tech equipment which could be used to attack these MCUs. Laser Fault Injection (LFI) is gaining more of a reputation for its ability to inject local faults rather than global ones due to its precision, thus providing a greater risk of breaking security in many devices. Although publications have generally discussed the topic of security of MCUs, attack techniques are diverse and published LFI provides few and superficial details about the used experimental setup and methodology. Furthermore, limited research has examined the combination of both LFI and Photo-Emission Microscopy (PEM), direct modification of instructions using the LFI, control of embedded processor resets using LFI, and countermeasures which simultaneously thwart other aspects including decapsulation and reverse engineering (RE). This thesis contributes to the study of the MCUs’ security by analyzing their susceptibility to LFI attacks and PEM. The proposed research aims to build a LFI bench from scratch allowing maximum control of laser parameters. In addition, a methodology for analysis of the Device Under Attack (DUA) in preparation for LFI is proposed, including frontside/backside decapsulation methods, and visualization of the structure of the DUA. Analysis of attack viability of different targets on the DUA, including One-Time Programmable (OTP) memory, Flash memory and Static Random Access Memory (SRAM) was performed. A realistic attack of a cryptographic algorithm, such as Advanced Encryption Standard (AES) using LFI was conducted. On the other hand, countermeasures to the proposed attack techniques, including decapsulation/RE, LFI and PEM, were discussed. This dissertation provides a summary for the necessary background and experimental setup to study the possibility of LFI and PEM in different DUAs of two different technologies, specifically PIC16F687 and ARM Cortex-M0 LPC1114FN28102. Attacks performed on on-chip peripherals such as Universal Asynchronous Receiver/Transmitter (UART) and debug circuity reveal new vulnerabilities. This research is important for understanding attacks in order to design countermeasures for securing future hardware

Novel Non-Invasive Technology for the Detection of Thin Biofilm in Piping Systems (phase - 1)

Biofilms are formed when a group of cells of microorganisms stick to each other and often on a surface. The development of biofilm has been a major issue in many fields (medical field, food, chemical, and water industry are a few such fields). In the medical field alone, biofilm infections have reportedly cost over five billion USD in additional healthcare expenses. The food industry usually halts the operation of its plant eight hours, every day to ensure that their equipment and transportation channels are clean and free from any biofilm presence. Similarly, the water and chemical industry need to ensure that their transportation channels are free from biofilm build-up to ensure that the flow rate of liquid flowing through the channels is neither affected nor contain bacterial traces. There is an immediate need for new technologies, that are both real-time and non-invasive that can be used to quantify biofilm formation in closed systems, which can reduce the loss incurred by the healthcare, food, chemical and water industry. This study investigates the use of a novel non-invasive and real-time technique that consists of two ultrasound sensors which can be mounted on a piping system. In this study, voltage and phase shifts were detected in materials with thickness greater than 40 µm, indicating that the sensor arrangement can be used to detect biofilm of thickness greater than 40 µm in a closed piping system. The results of objects present in the closed system cannot be obtained using conventional techniques such as the Raman microscopy, confocal laser scanning microscopy (CLSM) or other microscopy methods. This technique also allows in-situ detection (i.e. it avoids the need for inserting or extracting a coupon from the medium for measurement and eliminates the need to obstruct the operation of the system or the flow of measurement media through the system)