[论文解读] Oops..! I Glitched It Again! How to Multi-Glitch the Glitching-Protections on ARM TrustZone-M

Marvin Saß, Richard Mitev+1 more|arXiv (Cornell University)|Feb 14, 2023

Physical Unclonable Functions (PUFs) and Hardware Security被引用 5

一句话总结

本文提出 $μ$-Glitch，这是首个能够使用单一触发信号注入多个协调电压故障的电压故障注入平台，显著降低了故障参数的搜索复杂度。该平台成功在四款ARM TrustZone-M芯片上实现多故障注入——约一天内完成四次连续故障注入，有效绕过了专为单次故障设计的指令级故障注入防护机制。

ABSTRACT

Voltage Fault Injection (VFI), also known as power glitching, has proven to be a severe threat to real-world systems. In VFI attacks, the adversary disturbs the power-supply of the target-device forcing the device to illegitimate behavior. Various countermeasures have been proposed to address different types of fault injection attacks at different abstraction layers, either requiring to modify the underlying hardware or software/firmware at the machine instruction level. Moreover, only recently, individual chip manufacturers have started to respond to this threat by integrating countermeasures in their products. Generally, these countermeasures aim at protecting against single fault injection (SFI) attacks, since Multiple Fault Injection (MFI) is believed to be challenging and sometimes even impractical. In this paper, we present μ-Glitch, the first Voltage Fault Injection (VFI) platform which is capable of injecting multiple, coordinated voltage faults into a target device, requiring only a single trigger signal. We provide a novel flow for Multiple Voltage Fault Injection (MVFI) attacks to significantly reduce the search complexity for fault parameters, as the search space increases exponentially with each additional fault injection. We evaluate and showcase the effectiveness and practicality of our attack platform on four real-world chips, featuring TrustZone-M: The first two have interdependent backchecking mechanisms, while the second two have additionally integrated countermeasures against fault injection. Our evaluation revealed that μ-Glitch can successfully inject four consecutive faults within an average time of one day. Finally, we discuss potential countermeasures to mitigate VFI attacks and additionally propose two novel attack scenarios for MVFI.

研究动机与目标

• 为解决现代硬件防护背景下多重电压故障注入（MVFI）攻击缺乏实用工具的问题。
• 通过设计高效的参数搜索算法，降低MVFI中多重故障参数搜索空间的指数级增长。
• 证明在具备相互依赖的回查机制与故障注入防护措施的真实ARM TrustZone-M微控制器上，MVFI的可行性和有效性。
• 揭示现有以SFI为中心的防护措施在面对协调的多重故障攻击时存在不足。
• 为安全嵌入式系统中的MVFI提出新型攻击场景与防护对策。

提出的方法

• 设计并实现 $μ$-Glitch，一种专用硬件平台，可使用单一触发信号精确注入多个电压故障。
• 开发新型高效参数搜索算法，降低多重故障参数搜索的指数复杂度。
• 集成基于触发的同步机制，实现在单次固件执行过程中协调多个故障注入。
• 在四款真实ARM TrustZone-M MCU上评估 $μ$-Glitch，包括具备相互依赖回查机制与专用故障注入防护措施的芯片。
• 通过在特定、顺序排列的指令点注入故障，将攻击流程适配至针对指令级防护机制（如LPC55SXX与RT6XX MCU中的防护）的攻击。
• 采用以指令跳过为核心的故障模型，利用软件级故障防护机制中的漏洞。

实验结果

研究问题

• RQ1 能否构建一个实用且低成本的平台，仅通过单一触发信号实现多重电压故障注入（MVFI）的协调与顺序注入？
• RQ2 如何高效地导航多重故障参数指数增长的搜索空间，使MVFI在实践中可行？
• RQ3 在ARM TrustZone-M系统上，通过协调的MVFI攻击，现有以SFI为中心的软件与硬件防护措施在多大程度上可被绕过？
• RQ4 在针对具备复杂、相互依赖故障防护机制的真实MCU时，MVFI的实际限制与成功率如何？
• RQ5 能够实现协调MVFI后，会涌现出哪些新型攻击场景？它们如何颠覆传统对故障注入抗性的假设？

主要发现

• $μ$-Glitch在平均约一天时间内成功向ARM TrustZone-M微控制器注入了四次连续电压故障，证明了MVFI的实用性。
• 该平台仅使用单一触发信号即实现协调故障注入，克服了以往MVFI工具中的主要瓶颈。
• 通过针对多个连续指令点注入故障，攻击成功绕过了LPC55SXX与RT6XX MCU中的指令级故障注入防护机制。
• 研究发现，评估的两款芯片中相互依赖的回查机制在故障时机与序列被精心优化时，仍对MVFI存在漏洞。
• 作者证明，包括基于指令复制与片上回查机制在内的现有SFI聚焦型防护措施，无法有效抵御协调的MVFI攻击。
• 该工作揭示了一个关键威胁面：当前大多数防护措施假设攻击仅针对单次故障，导致系统极易遭受多重、协调的电压故障注入攻击。