IEEE TRANSACTIONS ON VERY LARGE SCALE INTEGRATION (VLSI) SYSTEMS, VOL. 32, NO.

7, JULY 2024 1311

FTC: A Universal Framework for Fault-Injection

Attack Detection and Prevention
Md Rafid Muttaki , Member, IEEE, Md Habibur Rahman , Akshay Kulkarni, Member, IEEE,
Mark Tehranipoor, Fellow, IEEE, and Farimah Farahmandi, Member, IEEE

Abstract— Fault-injection attacks (FIAs) represent a wide- Physical attacks can breach electronic systems’ confidentiality,
spread and potent method of compromising the integrity availability, and integrity [1], [2], impacting everything from
and confidentiality of integrated circuits (ICs) and electronic personal data to national security. For instance, attackers
systems. These attacks include voltage/clock glitching, electro- can reverse-engineer advanced technologies or exploit chips’
magnetic (EM) interference, laser, and optical injection. One
promising defense strategy is intrusion detection, which uses
vulnerabilities to gain unauthorized access or induce faults.
sensors to monitor and capture the effects of such attacks. This can jeopardize systems, as adversaries can manipulate
However, the diversity of these attacks has led to the development biometric authentication systems to access unauthorized data.
of specialized sensors for each attack type, posing challenges Physical attacks are a rising concern in cybersecurity [3].
in terms of feasibility and overhead. This article introduces a These attacks exploit security vulnerabilities to gain unautho-
universal solution for efficiently detecting prominent FIAs using rized access and compromise hardware assets. This is possible
a lightweight on-chip delay-based fault-to-time converter (FTC) due to the inherent susceptibility of underlying embedded
sensor. The proposed sensor functions by translating the conse- devices such as microprocessors and field-programmable gate
quences of fault attacks into measurable “time” differentials. This
design is readily implementable on both field-programmable gate
arrays (FPGAs) to physical attacks [4]. They are categorized
array (FPGA) and application-specific integrated circuit (ASIC) into three classes: noninvasive, semi-invasive, or invasive [5].
platforms. The sensor placement considers the most vulnerable An overview of physical attacks is presented in Fig. 1.
elements in the design to fault attacks to position them closely to Historically, invasive and semi-invasive attacks have been
those locations for extracting the best sensitivity to delay changes. considered less threatening due to the required costs and
We illustrate the sensor’s responses to major FIAs, demonstrating expertise. However, improved accessibility to advanced tools
its ability to differentiate between nominal and fault conditions. like FIB and scanning electron microscopy (SEM) has changed
The overhead analysis also highlights the sensor’s minimal this landscape, making physical attacks more feasible. Invasive
resource utilization in FPGA implementations. We also explore
attacks like reverse engineering and electrical probing lead
the sensor’s response to environmental variations for proper
characterization. to chip or device destruction [1]. For these attacks, access
to internal components, such as transistors or metal traces,
Index Terms— Clock glitching, electromagnetic (EM) fault- is needed. Printed circuit board (PCB) invasive attacks require
injection, fault-injection attack (FIA), fault-to-time con- accessing metal traces or components through methods like
verter (FTC), laser fault-injection (LFI), voltage glitching. polishing. The destructive nature of invasive attacks neces-
sitates expertise in sample preparation and physical attack
I. I NTRODUCTION methods, impacting time and cost.
Noninvasive attacks involve extracting assets without alter-
E MBEDDED and Internet-of-Things (IoT) devices have
become daily essentials—from smartphones, smart
homes, healthcare systems, and autonomous vehicles to
ing the device structure. Two types of noninvasive attacks,
active and passive methods, are prevalent. Passive attacks
involve side-channel signal analysis to expose sensitive
security-critical entities, i.e., military applications and financial data [6], [7]. However, these side-channel analyses become
systems. While they offer immense benefits, their security quite challenging for complex integrated circuits (ICs). More-
concerns have risen due to software attacks and physical over, researchers have proposed effective countermeasures
vulnerabilities. Modern electronics, especially in such harsh against different side-channel attacks adopted in modern semi-
environments, can be susceptible to physical attacks by the
conductor designs [8], [9]. The active approaches include
tools and techniques used for failure analysis (FA) if they
fault-injection attack (FIA), where abnormal conditions are
fall into the wrong hands. This poses risks like informa-
induced to gain unauthorized access to the chip functionality.
tion extraction and IP theft via probing, fault-injection, and
Recent instances have witnessed the rise of FIAs, emerging
reverse engineering. Initially developed for FA, tools such
as highly perilous hardware exploits. These attacks primarily
as probing, microscopy, and focused ion beam (FIB) have
improved over the last two decades. However, adversaries have pursue accessing confidential information [10], undermining
learned to exploit these tools to compromise chip security. data integrity [11], or inflicting denial of service [12]. FIAs
can be executed through various means, including voltage
Manuscript received 19 December 2023; revised 2 March 2024; accepted glitches [4], electromagnetic (EM) fault-injection (EMFI) [13],
20 March 2024. Date of publication 12 April 2024; date of current version clock glitch [10], optical fault-injection [14], and laser fault-
28 June 2024. (Corresponding author: Md Rafid Muttaki.)
The authors are with the Department of Electrical and Computer injection (LFI) (noninvasive) [15]. Ensuring system security
Engineering, University of Florida, Gainesville, FL 32611 USA (e-mail: necessitates the prompt detection of FIAs upon initiation.
[email protected]; [email protected]; [email protected]; However, their discreet and fleeting nature renders real-time
[email protected]; [email protected]). detection exceedingly challenging.
Color versions of one or more figures in this article are available at
https://doi.org/10.1109/TVLSI.2024.3384531.
As different FIAs have emerged, researchers have actively
Digital Object Identifier 10.1109/TVLSI.2024.3384531 investigated various on-chip strategies to identify and prevent
1063-8210 © 2024 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission.
See https://www.ieee.org/publications/rights/index.html for more information.
Authorized licensed use limited to: INSTITUTO FEDERAL DO CEARA. Downloaded on January 27,2025 at 13:20:08 UTC from IEEE Xplore. Restrictions apply.
1312 IEEE TRANSACTIONS ON VERY LARGE SCALE INTEGRATION (VLSI) SYSTEMS, VOL. 32, NO. 7, JULY 2024

Fig. 1. Overview of physical attacks [5].

these attacks. The solutions proposed thus far have predom- design-under-test (DUT). The sensor outputs are combined and
inantly centered around individual categories of attacks. For compared against the golden dataset using comparator-based
instance, when it comes to countering voltage glitch attacks, logic to detect faults at runtime. This allows the system to
innovative methods utilizing sense amplifiers, RC-circuit- immediately halt or reset normal operations, preventing FIAs
based, and a modified inverter configuration with RS latch from affecting the DUT.
detection techniques have been suggested [16], [17], [18]. The contributions of the research are stated as follows.
Similarly, researchers have put forward approaches using 1) We investigate the physical effects of individual FIAs
frequency detectors, clock monitors, and ring oscillators (ROs) on the targeted device. While the injection methods for
in clock glitch detection, showcasing efforts to safeguard each FIA might differ, the resulting impact would affect
against such vulnerabilities [19], [20], [21]. Meanwhile, the the circuit’s timing.
research community has explored alternatives like LC oscil- 2) We implement multiple instances of the FTC sensor on
lators, phase-locked loops (PLLs) as on-chip sensors, and the FPGA platform to emulate a system-on-chip (SoC)
watchdog RO with a Hogge phase detector (PD) for detecting environment and extract a unified response to detect
the frequency instability to address EMFI attacks, as evidenced FIAs effectively.
in [22], [23], and [24]. In tackling optical/laser FIAs, the pro- 3) We implement the SoFI framework in the FPGA
posed solutions have encompassed frequency ripple monitors environment to assess the DUT and find the most
and sensors integrated within the circuit’s “reset” signal tree FIA-vulnerable locations to place sensor instances effi-
using buffer-based mechanisms, as indicated in [25] and [26]. ciently.
Combining techniques to counter FIAs is plausible yet chal- 4) Based on the vulnerable locations and fault model,
lenging due to potential high overheads in area and power. The we consider the sensor placement as an optimization
risk of physical interactions impacting detection also calls for problem and propose a mixed-integer linear program-
a prompt need for a universal, lightweight solution within the ming (MILP)-based solution to minimize the cost
research community to address FIAs effectively. function.
From a different point of view, the existing research 5) We implement the overall framework on 28-nm Xilinx
lacks a comprehensive evaluation of hardware designs for Zynq FPGA. To showcase the framework’s efficacy,
susceptibility to FIAs during early stages, such as register we implement the FIAs mentioned above, i.e., voltage
transfer level (RTL) or gate-level design. Automated tools lack glitch, clock glitch, EM fault, and optical/laser FIAs,
the ability to predict potential fault-injection vulnerabilities, and report the sensor output to differentiate nominal vs.
or security breaches in specific design locations. Designers attack conditions. The results show that the framework
lack a well-defined method to pinpoint critical areas for pro- effectively identifies such attacks with high precision.
tection against FIAs, often resorting to safeguarding the entire The remainder of this article is organized as follows.
design. This approach is resource-intensive and impractical. We briefly discuss how the FIAs are formulated, the reported
Hence, it is crucial to devise a practical assessment technique fault attacks, and the shortcomings of relevant detection tech-
to accurately gauge design vulnerability to FIAs before the niques in Section II. Section III describes the sensor-based
silicon stage. This assessment would enable the development framework for FIA detection. In Section IV, we present the
of localized countermeasures, optimizing protection without experimental setup and results of the framework under differ-
compromising area, power, or performance. Additionally, ran- ent attacks and environmental variations. Finally, Section V
dom faults may not yield successful outcomes considering concludes this article.
an attacker’s perspective. Successful attacks typically involve
faults that breach security properties (SPs). Consequently, II. BACKGROUND
a fault-injection vulnerability assessment should be guided by
a set of SPs within the design. Ensuring that injected faults do A. FIA Techniques
not violate these properties substantially can enhance design In this section, we discuss the noninvasive and semi-invasive
security and resiliency. active FIAs, i.e., voltage glitch [4], clock glitch [10], EM fault-
This research proposes a comprehensive framework to injection [13], and optical/LFI [14] as these attacks are
detect FIAs (red font in Fig. 1) by considering the limitations primarily inexpensive, frequently reported, and easy to carry
of the existing methodologies. This framework comprises out. Also, we describe how to address them using our proposed
SP-driven vulnerability assessments of ICs against FIAs called framework in Section III.
SoFI [27] and a universal FIA detection sensor named fault- 1) Voltage Glitch: A cost-effective fault injection approach
to-time converter (FTC) [28], [29] to address FIAs based on involves manipulating a device’s power supply, such as using
Authorized licensed use limited to: INSTITUTO FEDERAL DO CEARA. Downloaded on January 27,2025 at 13:20:08 UTC from IEEE Xplore. Restrictions apply.
MUTTAKI et al.: FTC: A UNIVERSAL FRAMEWORK FOR FIA DETECTION AND PREVENTION 1313

a MOSFET switch to create a voltage glitch attack. A sudden may provide incomplete fault coverage. For instance, parity-
drop in supply voltage can be induced by momentarily shorting based EDCs can detect any fault with an odd number of bit
two nets with different voltage levels, causing an undervoltage errors within a single byte [42]. In modern SoCs, one of the
attack [30]. This technique, known as voltage undershoot, prominent uses of ECCs is found in the memory units as
introduces transient faults into the device. Let us consider the technology scaling causes increasing error rates [43], [44].
the voltage undershoot (low-power supply) where the timing To address these errors, the main memory manufacturers have
constraint can be specified as follows [31]: started using on-die ECC to rectify uncorrelated single-bit
errors within the memory [45], [46]. With the advancement in
tck > dclk2q + dpMax + tstp − tskew . (1) research, the newly proposed ECC units for memory chips and
Here tck , tskew , dck2q , dpMax , and tstp are clock cycle time, clock controllers can be highly efficient with smaller overheads [47].
skew, internal register delay, setup time, and data propagation However, these ECC techniques are developed considering
time through combinational logic, respectively. A dip in supply a particular structure of a dynamic random access memory
voltage will lead to an increased dpMax and induce fault in (DRAM) [48], inappropriate for protecting/correcting different
design timing. modules of an SoC responsible for performing specific opera-
2) Clock Glitch: Another noninvasive fault injection tions. Additionally, it is practically impossible to assign ECCs
method involves manipulating the clock signal to induce to each operation/functionality of a large SoC with limited
setup/hold time violations [32]. Reducing the clock cycle dura- overhead and without impacting the intended efficiency.
tion (Tg ) through premature toggling introduces a glitch where Several EDC techniques have recently been proposed on
Tg becomes less than the combinational logic’s maximum different ciphers that offer high error coverage with varying
path delay (τ ). This can cause subsequent registers to capture overheads. In the following section, we discuss the impact of
erroneous data, leading to transient faults propagating through these techniques on the ciphers.
the circuit. Such faults, known as clock glitches, can result a) ASCON: ASCON, being one of the finalists for
in skipped instructions or incorrect data storage in memory the National Institute of Standards and Technology (NIST)
modules [33]. Despite their impact, these faults leave no trace lightweight cryptography (LWC) standardization competition,
of tampering [34]. received standardization in February 2023 [49]. ASCON is
known for its strong security, minimal footprint, and hashing
3) EM Fault-Injection: EM injection perturbs the magnetic
field around a target device, inducing Eddy currents and caus- capabilities. However, fault attacks proposed in [50] and [51]
ing global power fluctuations, potentially leading to single-bit have successfully targeted the ASCON S-Box vulnerabilities.
faults [35]. Such faults, easily induced with low-cost tools like To address this, the error detection scheme presented in [52]
shows exceptionally high error coverage.
a gas lighter [36], pose a significant security risk by potentially
leaking sensitive data such as cryptographic keys [35]. These b) WAGE: WAGE cipher [53] is a 259-bit lightweight
attacks exploit the magnetic properties of electronic devices, permutation derived from the Welch–Gong (WG) stream
compromising their integrity and security. cipher. Despite its integration of both AEAD and WG-7
4) Optical and LFI: A powerful and precisely directed transformation, WAGE remains vulnerable to statistical fault
light beam, such as a laser, can induce modifications in logic analysis and differential fault analysis, even with the inclu-
gates by generating electron-hole pairs at the drain of nMOS sion of supplementary security measures, as outlined in [54].
transistors, leading to current pulses. These pulses charge the Kaur et al. [55] introduced an error detection scheme for
load capacitance, causing voltage pulses to propagate as tran- the nonlinear sub-blocks of WAGE cipher with reasonable
sient faults through the circuit. By targeting specific transistors overheads.
within static random access memory (SRAM) cells, attackers c) Camelia: Camellia encryption is a secure, symmetric
can flip the cell’s state at will [37] and in a reproducible key cipher with 128-bit data size and secret key lengths
manner [38]. from 128 to 256 bits [56]. The studies in [57] and [58] intro-
duce signature-based and CED methods, respectively, on the
Camellia block cipher to improve the reliability of hardware
B. Related Work implementations of these processes. However, the proposed
Countermeasures against FIAs keep adapting as the FIAs techniques incur significant overheads of 21% and 83%, which
become more advanced. They are developed based on a can become unfeasible in practical implementation scenarios.
balance between security and overhead trade-offs, aiming to d) Midori: Another lightweight block cipher, Midori,
make attacks sufficiently costly without being impossible. was designed to minimize energy consumption during encryp-
These countermeasures fall into two main categories: error tion and decryption operations within the circuit [59].
detection and intrusion detection. Differential fault analysis has successfully retrieved encryption
1) Error Detection: Error detection at the algorithm level keys with high probability on Midori cipher as presented
involves adding redundancy to detect injected faults, known in [60]. To detect these errors, Aghaie et al. [61] present
as concurrent error detection (CED). Redundancy is achieved an error detection architecture for Midori showcasing error
through hardware (e.g., adding extra components like in triple coverage of close to 100% with reasonable overheads (<15%).
modular redundancy [39]), time (repeating processes), or infor- e) QARMA: QARMA is a lightweight tweakable cipher
mation (using error detection or correction codes) [40]. While that derives its cryptographic characteristics from the block
hardware and time redundancy can significantly increase ciphers PRINCE, Midori, and MANTIS [62]. QARMA, while
design size (2 to 3 times) and slow performance, making claiming acceptable security margins, can be susceptible to
them less suitable for large designs [41], information redun- malicious faults leading to erroneous outputs and fault attacks.
dancy through codes like error detection codes (EDCs) or For exposing errors due to such anomalies, a signature-based
error correction codes (ECCs) offers lower overheads but error detection technique has been presented in [63] with error
Authorized licensed use limited to: INSTITUTO FEDERAL DO CEARA. Downloaded on January 27,2025 at 13:20:08 UTC from IEEE Xplore. Restrictions apply.
1314 IEEE TRANSACTIONS ON VERY LARGE SCALE INTEGRATION (VLSI) SYSTEMS, VOL. 32, NO. 7, JULY 2024

coverage close to 100% with ∼20% overheads. Another study

in [64] leverages a message authentication code (MAC) rooted
in QARMA to counteract Rowhammer attacks.
f) AES s-Box Error Detection: Different techniques have
been proposed in the literature for the AES s-box error
detection by representing polynomial basis into normal, mixed,
and redundant bases [65], [66], [67], [68]. In [65], a stream-
lined fault detection method is presented using the normal
basis for the s-box fault detection. The FPGA implemen-
tation of the technique required 25.8% slice overhead with
minimal impact on timing delays. Mozaffari-Kermani and
Fig. 2. Block overview of critical location extraction steps using SoFI.
Reyhani-Masoleh [66] introduced a high-speed architecture
that formulates multibit parities for the s-box using mixed
bases. However, this approach entails a trade-off between unit in the device. Despite the diversity of approaches, these
error coverage and timing overhead. The redundant basis solutions often entail significant costs, design complexity, and
implements fault detection in encryption by performing a test overheads. A comprehensive strategy addressing the wide
decryption post-encryption to check if the original data is range of FIAs with a unified, parameter-based solution remains
recovered, using redundancy at various levels, i.e., algorithm, lacking in the existing literature.
round, and operation level. However, these schemes result in a
time penalty during the decryption or comparison process [67].
C. Threat Model
In [68], another redundancy strategy is proposed for the s-box
fault detection that uses an inverse s-box after the original one In this work, we focus solely on assessing the suscep-
with good efficiency but extremely high overhead (∼100%). tibility of common FIAs, like voltage/clock glitch, EMFI,
g) PQC Kyber: PQC Kyber undergoes the NIST stan- and optical/laser FIA. The adversary aims to manipulate
dardization process and serves as a key exchange mechanism security-critical areas within the design using fault-injection
(KEM) protocol relying on the difficulty of the module techniques to compromise the targeted SPs. To provide a
learning-with-errors problem [69], [70]. Ravi et al. [71] comprehensive solution, we consider a robust attack model
thoroughly examine side-channel and FIAs on lattice-based where the adversary possesses complete gate-level information
schemes, with particular emphasis on Kyber. Another work about the design obtained from an untrusted foundry, reverse
engineering, IP theft, or cooperation with a rogue employee
on Kyber presented in [72] conducts side-channel attacks
in the design house. Furthermore, we assume the attacker
on Kyber for FPGA implementation. Fritzmann et al. [73] can achieve the maximum theoretical precision achievable
present error-correcting codes to significantly improve KEM by each FIA. For instance, in the case of clock glitching,
protocols’ failure rate, security level, and bandwidth. they can inject a fault precisely in a particular register by
h) NTT: Number-theoretic transform (NTT) is another extending the data path delay of that register. Consequently,
error detection scheme standardized by NIST in 2022. Previ- the practical vulnerable locations in a real-world FIA, with
ous attempts on NTT error detection are presented in [74] potentially lower precision, would always constitute a subset
and [75]. Sarker et al. [74] construct hardware for error of the identified critical locations with this framework.
detection of NTT, while Sarker et al. [75] present new error
detection schemes in NTT for detecting transient and perma-
III. P ROPOSED F RAMEWORK FOR FIA D ETECTION
nent faults.
With the above discussion, we can see several EDC tech- A. Critical Location Identification
niques that can work on specific cipher structures, ensuring To effectively extract the sensor response from areas critical
high error coverage with acceptable overheads, have already to the security of a circuit, it is essential to determine the
been proposed. However, each method differs from the other locations of security-critical cells/nets in the design. The
and entirely depends on the cipher under consideration. For placement of the developed FTC sensor will depend on the
this reason, these techniques fall short of providing a compre- positions of these identified wires or registers. The rationale is
hensive solution for detecting FIAs in an SoC environment. that a fault in one of these elements will impact the sensor’s
2) Intrusion Detection: Intrusion detection systems aim to response. By observing the changes in the sensor response,
protect devices from tampering by blocking physical access we can also establish a connection between a specific SP
and countering specific FIAs. These techniques include shield- violation and the corresponding alterations in the sensor’s
ing the chip with wire mesh [76], [77] and employing output. To pinpoint the exact wires and registers crucial for
analog sensors, i.e., light sensors and frequency detectors potential SP violations, we employ the SoFI [27] framework.
to detect optical fault-injection, probing attacks, and volt- 1) SoFI Framework: The security property-driven vulner-
age/clock glitch attacks [26]. While various countermeasures ability assessment framework (SoFI) identifies design areas
have been proposed for FIAs [16], [17], [20], [22], [23], [25], most susceptible to FIAs based on specific SPs and attack
[26], [78], [79], [80], each typically targets a specific type types. It highlights where an adversary might attack to com-
of attack and has its drawbacks. For example, some methods, promise confidentiality or integrity. SoFI targets design areas
like the sense amplifier-based approach in [16], may not detect relevant to the evaluated SPs, originally designed for the
certain glitches. In contrast, the RC-based detector in [17] application-specific integrated circuit (ASIC) flow. To adapt
suffers from continuous current leakage. Clock glitch detection it for FPGA use to conform with the FTC sensor imple-
methods in [78] and [79] involve real-time error detection, mentation, particularly in the Xilinx Vivado platform [81],
impacting performance and introducing high overheads. EMFI modifications were made for compatibility and identifying
detection technique in [23] relies on the presence of a PLL critical locations. Fig. 2 outlines the block-level steps for
Authorized licensed use limited to: INSTITUTO FEDERAL DO CEARA. Downloaded on January 27,2025 at 13:20:08 UTC from IEEE Xplore. Restrictions apply.
MUTTAKI et al.: FTC: A UNIVERSAL FRAMEWORK FOR FIA DETECTION AND PREVENTION 1315

Fig. 3. (a) Fan-in segment. (b) Signal property 1 waveform. Fig. 4. Segment of a gate-level schematic of AES in Vivado tool with an
extracted fan-in circuit for security property 1.

FPGA-specific implementation, including fault model charac-

terization, fault list generation based on the fault model and
SPs, and fault simulation to pinpoint critical locations. The
main steps of the framework can be detailed as follows:
a) Executable SPs: The SoFI framework models faults
for different fault attacks by focusing on critical areas with
sensitive data. It necessitates defining SPs that fault attacks
could violate, ensuring FIAs are considered effective only if Fig. 5. Identifying critical faults using SoFI framework. (a) Identifying
critical faults. (b) Fault lists with critical faults.
they compromise these properties. Not every fault will breach
all SPs; SoFI requires that an attack violates at least one
specified security criterion, which must then be converted window between control signal activation and SP verification.
into executable formal representations with defined verification In Fig. 3(b), an attack starts at clock cycle 14 (when “load”
metrics. signal is raised) and ends at clock cycle 17, targeting any cycle
An example security property 1 (SP1) can be defined as within for an SP breach. Global faults like voltage or clock
follows. It states that the “done” signal indicating the end of glitching affect sequential cells, while local faults from laser
ten AES encryption rounds should not be activated in the first or FIB attacks may target both sequential and combinational
round. Violating this property will lead to the availability of circuit areas. The fan-in circuit for SP1 is shown in Fig. 3(a)
the first round computation results, weakening AES security. with three input signals (“reset,” “clock,” and “load”) and an
Fig. 3(a) and (b) shows a 4-bit counter fan-in circuit for the output signal (“done”). SP1 is checked by examining the rising
“done” signal and the waveform of AES SP1, respectively. edge of the “done” signal.
Normally, the “done” signal activates nine clock cycles post- d) Fault Simulation and Critical Location Identification:
first round, but a fault can trigger it just three cycles after Fault simulation, performed with the Synopsys Z01X simula-
loading the AES keys, breaching the property. tor [82], helps identify critical locations for fault injection and
We have illustrated a simple example of AES “done” signal assess SP violations. Based on the fault locations, a preventive
above to explain how an SP can be used to characterize a countermeasure for FIAs can be incorporating an active shield.
certain behavior in the design. However, in practical designs, Faults can be injected at the SP check point or within the fan-in
the designer needs to identify the assets, critical operations, circuit, with the simulator detecting any property violations.
and functionalities in light of confidentiality, integrity, and Analysis of the generated fault list reveals whether the list
availability metrics of the design and the considered fault effectively breaches SPs and the specific locations of these
model (discussed in detail in Section III-A1b). Based on these violations.
parameters, the designer can identify a set of attributes in SPs like SP1 are breached only when faults are injected at
the design (i.e., control signals, outputs, and fan-in circuits) specific locations, i.e., the fan-in circuit of the “done” signal.
that need to be protected and generate SPs to characterize the Faults that successfully breach security are termed “effective”
expected functionality. faults. Among these, “critical” faults are a subset where every
b) Fault Modeling: Different fault injection methods like fault location is essential for violating the security property.
voltage/clock glitching, EMFI, FIB, or optical/laser attacks Not all effective faults are critical; some may originate from
require unique fault models due to their varied processes. multiple locations without all being necessary for a breach.
Fault modeling translates an attack’s physical effects into Critical faults require all involved locations to contribute to the
attributes such as fault category (global or local), location security violation. Fig. 5(a) shows a test case on identifying
(dispersed or specific circuit parts), timing (critical moments both effective and critical faults. While faults 5 and 6 are
for vulnerability), fault type (transient or permanent), and effective, they are not critical because locations “D” and “E”
attack duration (based on circuit functionality). Fig. 4 shows are not essential for SP1 breaches for cases 5 and 6, respec-
a segment of the gate-level schematic of AES, highlighting a tively. In these cases, a fault at location “F” directly violates
critical circuit related to Security Property 1 (indicated in a SP1, making it critical. Conversely, fault 4 is both effective
red, illustrating the specificity needed in fault modeling. and critical as locations “D” and “E” are indispensable for the
c) Fault List Generation: To analyze system vulnera- fault’s impact.
bilities, a detailed fault list is created based on SPs and 2) Multiple Fault Locations for FTC Sensor: Ideally,
fault models, focusing on four main attributes: fault-injection designers aim to equip the entire chip with detection mech-
timing, location, fault type, and duration. Typically, faults anisms like fault sensors for intrusion detection. However,
are transient bit flips occurring within a defined attack due to constraints like overhead and resource requirements,
Authorized licensed use limited to: INSTITUTO FEDERAL DO CEARA. Downloaded on January 27,2025 at 13:20:08 UTC from IEEE Xplore. Restrictions apply.
1316 IEEE TRANSACTIONS ON VERY LARGE SCALE INTEGRATION (VLSI) SYSTEMS, VOL. 32, NO. 7, JULY 2024

it is impractical to deploy numerous sensors. To place sensors

both effectively (to detect FIAs) and efficiently (minimizing
the number needed), we utilize the SoFI framework’s analysis
of critical locations. The identification of these locations
depends on the types of attacks and defined SPs; different
attacks or properties would highlight different critical areas.
By aggregating SoFI findings across various attack scenarios
and security considerations, designers can pinpoint crucial
wires/registers for sensor placement. The goal is to position
FTC sensor instances near these critical spots to monitor for
potential security breaches.
Sensor placement is based on fault-prone areas and the FIA
type, adapting from local to global impacts. When devising a
sensor placement strategy for highly localized attacks, such Fig. 6. Applying constraints on identified critical locations during imple-
as laser attacks, the method will likely be effective across mentation (floorplan) stage.
various FIAs. We consider the challenge of placing sensors
near clusters of vulnerable locations and areas affected by the designer’s requirements. Finally, we use the MILP [84]
laser attacks as an optimization problem [83]. This approach to solve the objective function with the defined constraint
involves defining parameters to achieve an optimal place- equations.
ment solution with minimal cost, considering each vulnerable Based on the above discussion, if the identified locations by
location identified by the SoFI framework corresponds to a the SoFI framework are far apart, then by the cluster definition,
configurable logic block (CLB) in the FPGA. A cluster can be each cluster will contain a single CLB requiring a dedicated
defined as a set of fault-vulnerable CLBs, where the distance sensor instance (5). Additionally, if the identified locations
from one CLB to all other CLBs is ≤(x 2 + y 2 )1/2 . Here, x are in the middle region of a large module, then the sensor’s
and y are the length and width of a sensor instance in the efficacy can decrease (discussed in detail in Section IV-D).
FPGA floorplan. Let M = number of CLBs vulnerable to These scenarios are not ideal as the identified CLBs dis-
LFI attack in a cluster, K = CLBs the LFI can impact at persed within a large design will necessitate many sensors,
a time provided at least one of them is fault-vulnerable, P = resulting in higher overheads without ensuring high efficacy.
sensor instances available, z sc is a binary decision variable to We follow the steps illustrated in Fig. 6 to address this.
represent whether a sensor instance is assigned to a cluster, First, we implement the design with a nominal configuration
xs ji = distance between a sensor and each CLB impacted by based on the design specifications and run the SoFI framework
the LFI attack in a cluster, d ji = distance between jth fault later. By locating the fault-vulnerable elements in the design,
vulnerable CLB and ith CLB impacted by the LFI attack in a we apply constraints during the floorplanning stage to place the
cluster, and xsc = distance between a sensor s and a cluster of identified cells near the edge of the design module/s. In Fig. 6,
fault vulnerable CLBs c. Now, we define the objective function we consider two scenarios, one at the IP level and the other at
and constraint equations as follows: the SoC level. In both scenarios, the constraints are applied to
XP facilitate placing the fault-vulnerable cells nearby. In a single
f = xsc (2) module, we can apply this process to the design (i.e., AES
s=1 core), whereas one or more modules undergo this process
M X
X K at the SoC level. This enables an efficient output from the
xsc ≤ (1/M K )


xs ji + d ji ∀s, c (3) optimization tool, resulting in fewer sensor instances (“S1” for
j=1 i=1 Sc. 1 and “S1, S2” for Sc. 2 in Fig. 6) placed optimally near
0 ≤ xsc ≤ 1 ∀s, c (4) the vulnerable locations.
P
X
z sc = 1 ∀c. (5) B. FTC: Fault-to-Time Converter
s=1 In this section, we provide a comprehensive overview of the
Equation (2) defines the objective function, which min- architecture and operational principles of the FTC sensor.
imizes the total distance from all the sensor instances to Identifying a common parameter among various FIAs is
all clusters of fault-vulnerable CLBs. In this optimization essential to develop a universal sensor for effective detection.
problem, we focus on the scenarios where fault-vulnerable These attacks manipulate power lines, system clocks, magnetic
CLBs overlap with the LFI-impacted CLBs. Equation (3) fields, and transistor behavior, leading to changes in intercon-
describes the constraint where the distance between a sen- nect delays and overall circuit timing. The analysis emphasizes
sor instance and a cluster is ≤ the normalized distance that FIAs can be translated into measurable “time” changes.
between a sensor and all fault-vulnerable CLBs situated in Most FIAs induce voltage fluctuations, impacting delay line-
that cluster considering LFI impact on multiple CLBs at a based sensors. However, clock glitch attacks directly affect
time. Equation (4) defines the boundary condition for the the sensor output, causing anomalies during result sampling.
distance parameter between a sensor and a cluster. Based A sensor must consistently monitor delay variations to detect
on the problem formulation, we require another constraint to subtle timing alterations caused by the FIAs. The proposed
ensure each sensor instance is assigned to a fault-vulnerable solution is the FTC sensor, which monitors the impact of FIAs
CLB cluster defined by Equation (5). Additionally, constraint as delay changes in the circuit. It employs a dual-delay line,
equations such as “not using more resources than allocated as illustrated in Fig. 7 with low and high threshold voltage (Vt )
(for meeting overhead specifications)” can be used based on buffer cells. This design enhances sensitivity to minimal delay

Authorized licensed use limited to: INSTITUTO FEDERAL DO CEARA. Downloaded on January 27,2025 at 13:20:08 UTC from IEEE Xplore. Restrictions apply.
MUTTAKI et al.: FTC: A UNIVERSAL FRAMEWORK FOR FIA DETECTION AND PREVENTION 1317

Fig. 7. FTC sensor architecture. Fig. 8. Instance of AES with identified security critical locations.

changes caused by FIAs, representing a pioneering approach to locate the security-critical locations prone to FIAs. Fig. 8
in FIA detection. Unlike previous methods, such as in [85], highlights three circled clusters within the “AES_top” module,
unable to capture transient changes, the FTC sensor efficiently identifying critical locations vulnerable to FIAs based on
captures transient changes, operating at the speed of its driver the definition in Section III-A2. Two clusters (1 and 2) are
clock. depicted in a zoomed-in view, showing four registers each
In Fig. 7, the external clock signal is adjusted to the desired on both sides of the AES, with their cell names visible.
frequency by scaling the sampling clock generator. This scaled Cluster 3 can also be zoomed in to identify the remaining
signal drives the FTC block, detecting timing delay variations critical locations. Utilizing MILP for optimization, as per
caused by FIAs. Unlike traditional time-to-digital converters Equations 2-5, we strategically placed three sensor instances
(TDC) [86], the FTC incorporates both high Vt (HVT) and (shown in Fig. 9) around these locations. After calibrating the
low Vt (LVT) cells within buffer lines to enhance sensitivity sensors to record nominal outputs for baseline comparison,
to voltage and timing variations. The sampling clock splits we subjected them to various FIAs to monitor the effectiveness
into two paths within the FTC framework for driving the of each sensor by comparing outputs under normal and FIA
HVT and LVT buffer delay lines. These delay lines capture conditions.
XOR outputs from each HVT and LVT buffer cell, stored Fig. 9 shows the block level setup for detecting FIAs in an
in latches once enabled. A flip-flop stage loads these cached FPGA running an AES encryption engine, with three sensor
readings. A bubble-proof encoder filters out unexpected 0s and instances strategically placed near FIA-vulnerable spots as
identifies the longest sequence of 1s. Sensor range fine-tuning determined by optimization. This multisensor approach mim-
adjusts initial and observable buffer lengths, with optimal sizes ics an SoC environment to effectively cover multiple critical
determined through post-implementation timing simulations locations, i.e., nets and registers, acknowledging that a single
to ensure consistent XOR output and identify the longest 1s sensor is insufficient for efficient attack detection. Addition-
sequence while modifying initial buffer lengths and keeping ally, immediate fault detection is crucial to safeguard design
the observable length constant. assets in real-time, which makes post-processing inadequate.
The FTC sensor, adaptable for ASIC platforms, requires a We use a comparator-based structure for instant fault detection.
technology library containing different Vt cells. This prereq- The decision logic for fault conditions is the “Detect Fault
uisite is incompatible with FPGAs due to their uniform Vt Condition” block, in which the designer can use any logic
SRAM cells. Nevertheless, for prototyping, we adapted the block, i.e., AND / OR based on the design requirements to decide
sensor for FPGAs by simulating different Vt cells’ behavior upon the fault condition. This block’s output can be utilized
using transparent lookup tables (LUTs) to create variable in multiple ways based on the security requirements of a DUT
delays, emulating LVT and HVT cells with different LUT to prevent the FIAs from impacting it. One way is to use the
configurations (e.g., 1-LUT for LVT, 2-LUTs for HVT). This output wire/signal and instantaneously raise a flag signal to
approach allows us to mimic actual LVT/HVT cell delay alert the user [11]. Additionally, the signal can be used as an
variations, increasing with more buffers. The sensor detects input to the controller of a running program to halt/reset the
the start and end of the longest sequence of 1s, averaging DUT [87]. Another intuitive way is by monitoring secret asset
these values for baseline data and adjusting for device and transactions in the DUT and observing if flag signal is raised
environmental differences with a threshold. Deviations from at a specific time, halting the operation accordingly. This way,
this threshold raise a flag to report the FIA condition. Sensor it deters the system from unnecessary resets. These approaches
accuracy relies on precise delay calibration and strategic can prevent the FIAs from impacting the DUT, deeming the
placement. attacks unsuccessful.
Initially, the system undergoes a trial run under the nominal
IV. E XPERIMENTAL S ETUP AND R ESULTS condition where encoded values for all sensor instances are
recorded. Then, we set a threshold for each sensor to account
A. Experimental Setup for intra-device and environmental variations and use them
We have used the Zybo Z7 Zynq-7000 FPGA board for as inputs to a set of comparators. Finally, we set the DUT
testing the sensor response against voltage glitch, clock glitch, to go through different FIAs, where the encoded outputs
and EM fault injection. We also used the AC701 evaluation of the sensors are compared to the preset threshold values
board due to its flip-chip configuration. This section discusses from the trial run. Finally, based on the unified response
how we use multiple sensor instances to detect FIA conditions from all sensor instances, a fault condition will get activated
in a running system effectively. For this purpose, we run the when the threshold is exceeded, and a flag will be raised.
SoFI framework first on the DUT (AES encryption design) In our implementation, we chose the observable delay length

Authorized licensed use limited to: INSTITUTO FEDERAL DO CEARA. Downloaded on January 27,2025 at 13:20:08 UTC from IEEE Xplore. Restrictions apply.
1318 IEEE TRANSACTIONS ON VERY LARGE SCALE INTEGRATION (VLSI) SYSTEMS, VOL. 32, NO. 7, JULY 2024

Fig. 9. Block diagram of 3-FTC sensor instance implementation for FIA detection.

Fig. 11. Comparison of sensor response with/without EMFI. (a) Golden

Fig. 10. Experimental setup for EMFI. dataset. (b) Sensor response under EMFI.

for buffers, labeled as N, as 30. This choice ensures sufficient can consider a smaller threshold region to detect the slightest
monitoring range for detecting delay variations in this setup. anomaly in the design. Finally, we applied the EMFI attack
As a result, the encoded output can span from 0 to 29 for with intensities 500, 700, 900, 1100, and 1500 V and annotated
each sensor. For detecting fault conditions, we observe the the sensor outputs as F1–F5 as shown in Fig. 11(b). With
start and end of the largest 1 s string for each sensor under the increased intensity, more bit flips can be found while
FIA conditions and compare it with the golden data from the monitoring the binary representation of the sensors’ responses
trial run. (start/end of 1 s string). Considering sensor responses for each
attack instance, we can see that the encoded outputs primarily
reside far away from the threshold region. However, due to
B. Sensor Response Against FIAs the locations of the sensor instances and the transient nature
In this work, we have considered four prominent FIAs, of the injected EM wave, all sensor outputs are not impacted
i.e., EMFI, voltage glitch, clock glitch, and optical/LFI. For similarly. For this reason, sensor 3 output for the F1 fault and
applying FIAs, we have used different setups as per the attack sensor 1 output for the F5 fault are found inside the threshold.
requirements. We discuss each attack setup and corresponding Nevertheless, each fault instance can be easily identified by
sensor responses in the following subsections. combining the results from all sensor instances.
1) Against Electromagnetic Fault-Injection: We have opted 2) Against Voltage Glitch: For the voltage glitch attack,
for the EMV-Langer E1 Immunity Development System [88] we have used a signal generator to effect a pulsed signal that
with a range of EM intensity and waveform options to imple- turns on an nMOS to make it act as a fast switch. Connecting
ment the EMFI attack. The setup comes with an EM generator, the drain and source of the nMOS to the capacitor terminals
several injection probes, and wire connectors to connect the can cause a momentary short circuit, resulting in a voltage
generator with the probes. The generator has two types of glitch in the victim device. For this purpose, we selected
pulse options: flat pulse, which maximizes the pulsewidth, and two capacitors C108 = 100 µF and C147 = 100 µF in the
steep pulse with a sharp but smaller width. The frequency of FPGA under test. After turning on the FPGA, we measured
the EM signal varies between 125 and 200 MHz. The EM the voltage across the two capacitor terminals to be 1.94 and
intensity ranges from 500 to 1500 V. For the EMFI attack 3.44 V, respectively. While connecting the drain and source
with this setup, we used a steep pulse, with an EM injection of the nMOS to C147 and turning the nMOS ON causes
probe on top of the FPGA chip without contact and varied the FPGA to switch OFF due to a high current flow and
intensity from 500 up to 1500 V. An overview of the EMFI significant voltage drop, connecting the positive terminals of
setup containing the FPGA as the victim device, EM injection C147 and C108 to the nMOS drain and source, respectively,
probe, holder, and a local machine for observing the sensor causes a large enough voltage drop to cause voltage glitch
outputs is shown in Fig. 10. without turning the FPGA OFF. For the switching functionality,
In the golden dataset, we observe three instances of sensor we used the RFP30N06LE, a power MOSFET capable of
outputs denoted as (1, 16), (9, 26), and (9, 29). These instances operating under a high-voltage environment. Fig. 12(b) shows
represent the beginning and end positions of the longest the transfer characteristics of the MOSFET under nominal
sequence of 1 s in the data, which is illustrated in Fig. 11(a) temperature (25 ◦ C). Based on the features of the MOSFET,
for the EMFI attack. For any intra-device and environmental we have used a pulsed signal from the signal generator with
variation, we set a threshold with a radius of 1 unit around a square shape, 10 Hz frequency, 3.7 V amplitude (peak-to-
the sensor outputs. Based on the design applications, the user peak), and a duty cycle of 10%. The voltage glitch setup is

Authorized licensed use limited to: INSTITUTO FEDERAL DO CEARA. Downloaded on January 27,2025 at 13:20:08 UTC from IEEE Xplore. Restrictions apply.
MUTTAKI et al.: FTC: A UNIVERSAL FRAMEWORK FOR FIA DETECTION AND PREVENTION 1319

Fig. 12. Experimental setup for voltage glitch attack. (a) Voltage glitch setup.
(b) MOSFET IDS versus VGS .

Fig. 14. Experimental setup for clock glitch attack. (a) Block diagram for
clock glitch. (b) Simulation waveform using the setup.

Fig. 13. Comparison of sensor response with/without voltage glitch.

(a) Golden dataset. (b) Sensor output for voltage glitch.

illustrated in Fig. 12(a). When the MOSFET gets turned ON,

a short circuit is created across the two terminals of the capac-
itor, causing a high-current flow within the FPGA, and the
Fig. 15. Comparison of sensor response with/without clock glitch. (a) Golden
device voltage comes down to a lower voltage, momentarily dataset. (b) Sensor output for clock glitch.
signifying an under-voltage attack.
In the golden dataset, we have three sensor instances outputs
(2, 8), (2, 16), and (9, 29) as the start and end of the largest 1 s “trigger” signal and internal register value of the 4-bit counter.
string shown in Fig. 13(a) for the voltage glitch attack. Similar As a result, the synchronization of FSM with the system clock
to the EMFI attack scenario, we set a threshold with a radius is not required in this implementation. When the “trigger”
of 1 unit around the sensor outputs. Finally, we applied the signal was activated, and the counter reached a predefined
voltage glitch attack with the signal generator configuration value, the FSM output a “high” signal. This “high” signal
mentioned above, and the selected capacitors of the FPGA. served as the “select” input for a 2-to-1 multiplexer (MUX).
We have used multiple instances of the attack and observed The MUX had two inputs, each connected to one of the two
the sensor outputs. Such two cases of the sensor outputs are clocks generated by the MMCM. When the “select” input went
(2, 9), (2, 17), (9, 29) and (2, 9), (2, 17), (9, 20) for attack “high,” the MUX altered its output, “clk_out,” transitioning
instances 1 and 2, respectively, as shown in Fig. 13(b). We can its frequency from the nominal 100 to 400 MHz in just one
see that the sensor 1 and 2 outputs under the voltage glitch clock cycle. This sudden change effectively disrupted the ref-
attacks reside within the threshold region. On the contrary, the erence clock frequency, causing a glitch. The key components
sensor 3 output changed drastically on both occasions. This involved in this glitch attack are illustrated in Fig. 14(a).
situation can arise due to the impact of the FIAs on the actual The resulting waveforms are presented in Fig. 14(b), where
location of the sensor instances and design elements, causing you can observe that the “clk_out” signal’s frequency shifts
significant delay changes. In this scenario, we can identify to 400 MHz when the “trigger” goes “high” and remains at
the fault attack instances using the OR logic as the fault detect this frequency until the end of the original clock cycle.
condition. This scenario provides a valid reason for the design In the golden dataset, we observe three instances of sensor
analysis using SoFI and using the required number of sensor outputs denoted as (0, 14), (9, 29), and (11, 29). These
instances rather than one to ensure efficient FIA detection. instances represent the beginning and end positions of the
3) Against Clock Glitch: For conducting the clock glitch longest sequence of 1 s in the data illustrated in Fig. 15(a)
attack, we employed the “Clocking Wizard” available within for the clock glitch attack. We set a threshold with a radius
the IP catalog of the Vivado software, a widely used tool in of 1 unit around the sensor outputs, similar to previous
FPGA design and programming. The reference clock for the experiments. Finally, we applied the clock glitch attack by
chosen FPGA is 100 MHz. We needed to create two distinct turning “on” the “trigger” signal from the external switch at the
clock signals with frequencies 100 and 400 MHz to execute the FPGA. We have applied the “trigger” multiple times for this
glitch attack. This was achieved using the FPGA’s multimode attack and recorded the outputs for the three sensor instances.
clock manager (MMCM). The MMCM generated these clocks Fig. 15(b) illustrates the sensor responses for seven instances
from the initial 100 MHz reference clock. These two clocks of the clock glitch attack. For example, sensor outputs are
were used one at a time as the reference clock for the DUT, (3, 21), (9, 27), (0, 0); (3, 21), (9, 27), (1, 16); and (3, 21),
which encompassed the FTC sensor and various other design (19, 27), (1, 16) for first three attack instances, respectively.
components. The glitch generation process involved an FSM The figure shows that the sensor’s encoded values reside
featuring a simple 4-bit counter. The FSM is independent of far away from the threshold region set in the nominal run.
the system clock (100 MHz) and only depends on an external This change in sensor outputs is because the setup and hold

Authorized licensed use limited to: INSTITUTO FEDERAL DO CEARA. Downloaded on January 27,2025 at 13:20:08 UTC from IEEE Xplore. Restrictions apply.
1320 IEEE TRANSACTIONS ON VERY LARGE SCALE INTEGRATION (VLSI) SYSTEMS, VOL. 32, NO. 7, JULY 2024

Fig. 17. Comparison of sensor response with/without LFI. (a) Golden dataset.
(b) Sensor output for laser attack.
TABLE II
OVERHEAD A NALYSIS BASED ON LUT U TILIZATION ACROSS
FPGA P LATFORMS FOR I MPLEMENTING FTC S ENSOR
Fig. 16. LFI setup.

TABLE I
M ICROSCOPE xy S TAGE C ONFIGURATION OF THE L ASER S TATION [89]

laser pulse. Fig. 17(b) shows the sensor outputs as (0, 9),
(0, 13), and (18, 29) under laser attack. The change in values
can be associated with bit-flips in the memory cells impacted
violations occur due to the arrival of a glitched clock edge by the laser pulse, i.e., in the flip-flops, block memories,
earlier than the actual edge. This effect introduces incorrect or reconfigurable circuit configuration bits. Additionally, the
latching of XORed values, resulting in changed data at the signal propagation gets impacted (increase/decrease), causing
encoded sensor outputs. Again, we observe that the fault attack violations in circuit timing in the logic chain [90]. The
scenario can be detected using a unified sensor response for CLBs consist of the logical part and the interconnect part.
the clock glitch attack. In the logical part, the LUTs and internal multiplexers are
4) Against LFI: To capture the sensor outputs during a the most sensitive to laser fault, whereas the fault impact on
laser FIA, we utilized the AC701 evaluation board designed interconnects depends on their initial states [91]. The average
for the Artix-7 FPGA, as the board possesses the essential change in modified bits due to laser attack depends on the
flip-chip configuration necessary for a successful laser attack. spot size and initial configuration of the logic blocks. Similar
For implementing the laser attack, we have used the Riscure to previous attack scenarios, with the obtained results, we can
laser station [89]. In this setup, we used the near-infrared detect the laser fault attack using the unified sensor response.
(NIR) laser with a 1064 nm wavelength. The maximum rated
laser pulse power is 20 W, where we used 45% of the beam
power (9 W). The maximum pulse frequency of the station C. Overhead Analysis
is 25 MHz. The spot size of the chosen laser is 6 × 1.4 µm. This section discusses resource utilization as part of the
The laser station also contains a microscope xy stage with the overhead analysis implementing the FTC sensor on FPGA
configuration specified in Table I. For applying the laser attack, platforms. Using different LUT configurations, we created
we have chosen 46 × 84 data points based on the floorplan models for HVT and LVT buffer cells to deploy the FTC
of the implemented design with 30 µm spacing between two sensor on FPGA platforms. To demonstrate the effectiveness of
attack points. Fig. 16 illustrates the experimental setup for the design, we opted to modify the LUT parameter to replicate
the laser attack where we can find the major components the varying intercell delays. More LUTs were required for
of the Riscure laser station and the FPGA under test. The the HVT cells to model these delay variations accurately
diode laser emits the laser light into the victim device. Using within the cells. For this reason, this elevated LUT count leads
the camera, the user can check the probing points from the to increased overall resource utilization (%) for the LUTs.
software tool. The beam splitter controls how much light Across both FPGAs, the primitives used are LUTs (871), reg-
should reach the camera from outside. The objective lens isters (88), and slices (272), which constitute the asset usage
options available for the system are 5×, 20×, and 50×, where percentage of 5.23% (0.69%), 0.25% (0.03%), and 6.18%
we used the later configuration. Finally, the xyz table facilitates (0.77%) for Zynq-7000 (AC701 evaluation board). Table II
three-dimensional movement to properly position the chip illustrates the resource utilization for LUTs for implementing
under the laser probe. the sensor on different FPGA platforms. It can be seen that the
In the golden dataset, we have three sensor instances outputs number of LUTs needed for the FTC sensor implementation is
(4, 13), (1, 13), and (24, 29) as the start and end of the largest almost identical. However, as the available resources (LUTs,
1s string shown in Fig. 17(a) for the laser FIA. We set the same registers, and so on) in the newer FPGA platforms increase,
threshold around the sensor outputs. Then, we set the FPGA the percentage of used LUTs becomes minimal. The same
under test on the xy stage and placed the flip chip underneath analysis can be extended for other resource types as well.
the laser probe by moving the stage accordingly using the Accessing various Vt cells from the technology library in
Riscure software. Then, we started probing the chip with the typical ASIC implementations is straightforward. These cells,
Authorized licensed use limited to: INSTITUTO FEDERAL DO CEARA. Downloaded on January 27,2025 at 13:20:08 UTC from IEEE Xplore. Restrictions apply.
MUTTAKI et al.: FTC: A UNIVERSAL FRAMEWORK FOR FIA DETECTION AND PREVENTION 1321

Fig. 19. Monte Carlo Simulation for process variation on a buffer chain with
300 samples.

Fig. 18. Proximity analysis of the FTC sensor. (a) Initial placement.
(b) Moving the upper block close to the sensor.
to observe the impact of mismatch and process variation.
As the sensor design is directed toward measuring delay
consisting primarily of two cascaded NOT gates, have similar variations through buffer cells, we have applied the Monte
physical area footprints, ensuring the sensor’s implementation Carlo simulation on a long buffer chain (comprising 40 cells).
occupies minimal space on the device. Additionally, the sensor We used the Cadence generic process design kit (GPDK)
can be isolated from the main application, preventing any 45 nm library cells to build the buffers for this analysis. Our
impact on the performance of the DUT. goal was to observe the mean delay at the output of the buffer
chain and compare it with the simulation results from a typical
D. Proximity Analysis run with no process variation. Fig. 19 illustrates the histogram
of sample distribution for the resultant delays. As can be
We have performed the proximity analysis on the proposed
seen, the mean of the delay parameter for the distribution is
FTC sensor. Based on our study, we observed that the sensor
found to be 704.102 ps for the 40 buffer cells. We performed
can detect delay variations from different proximity of the
another simulation with the typical–typical (TT) corner to find
active blocks. However, any alterations in the sensor’s place-
the nominal delay, which we found to be 702.389. These
ment will change the start, end, and length of the 1 s string
two values are nearly the same, emphasizing that the process
of the sensor output. For analyzing this, we have placed the
variation will not impact the intercell delays of the sensor
sensor in between two blocks of a RISC-V [92] SoC and then elements to alter the intended outputs.
varied the position of the sensor with respect to these blocks.
2) Temperature Variation: To identify the effect of tempera-
For instance, Fig. 18(a) shows the initial placement of the three
ture on the proposed sensor structure, we need to find the delay
blocks comprising the FTC and two blocks. The upper block
variation of unit cells (buffers) in the design. We again used
consists of the fetch, issue, and multiplier, whereas the lower
the Cadence GPDK 45 nm library to design a single buffer
block includes execution, division, load/store unit (LSU), and
for simulating the temperature impact. For the simulation,
control and status registers (CSRs).
we considered the temperature range (−25 ◦ C–125 ◦ C) for
With this configuration, the start and end of 1 s string are
three process corners [TT, fast-fast (FF), and slow-slow (SS)]
found as (11,28). We have brought the upper block closer to
at VDD = 1.1 V. Fig. 20 shows the change in unit buffer
the FTC sensor to observe the impact of placement change,
least significant bit (LSB) delay measured in picoseconds (ps)
as illustrated in Fig. 18(b). The updated sensor output was
due to the temperature variation. The figure illustrates the
observed as (13,38) with the changed placement. In the first
slightest delay increase at the FF corner, followed by the
instance, the 1 s string length is 18 compared to 25 in the later
TT and FF corner. This result is expected as the FF corner
case. This behavior can be explained as follows. When the
considers the fast nMOS/pMOS transistors having the least
upper block is placed far away from the sensor, the detected
intercell delay. In contrast, the SS corner assumes the slow
delay variation at the sensor becomes minimal, resulting in
nMOS/pMOS transistors have the most intercell delay. The
more XORed 0 s and less 1 s. However, placing the block
TT corner exhibits the delay profile between the FF and SS
closer to the sensor causes the HVT and LVT cells to transmit
corners. The increasing nature of delay can be attributed to the
more 1 s than before. For this reason, the 1 s string length
difference between VDD = 1.1 V and the threshold voltage of
increases to 25 for the later case. Additionally, we can observe
the transistors Vt ∼ 0.65 V which ensures the carrier mobility
the variation of LVT and HVT cell shift from the start and
plays a dominating factor rather than the threshold voltage Vt .
end values of 1 s string. The start value (13) signifies that
On the contrary, while considering a reduced supply voltage,
two new HVT cells transmitted 1, whereas the end value (38)
i.e., 0.8 V, the LSB delay can decrease with increasing tem-
indicates that ten new LVT cells carried 1 compared to the
initial placement. This shift is also expected as LVT cells perature [95] as the supply voltage becomes comparable to Vt ,
supposedly introduce more 1s than HVT cells. making it the dominating factor. This phenomenon is known
as temperature inversion [96]. In the FPGA implementation
with a 28 nm library, we have found the averaged LSB delay
E. Sensor Response With Environmental Variation to be ∼550 ps. If we scale down the simulated delay profile
Along with efficacy in detecting FIA conditions, the pro- using the GPDK 45 nm library with temperature impact, the
posed sensor must be effective under environmental variation. change in LSB delay will become ∼5 ps, which is minimal
This section discusses the effect of process, temperature, and compared to the nominal cell delay.
supply voltage variation on the FTC sensor. 3) Supply Voltage Variation: We consider the impact of any
1) Process Variation: It is imperative to evaluate the sensor change in the supply voltage by applying a range of VDD to
performance at varying process corners to ensure the efficacy the buffer chain of the FTC sensor. For this analysis, we used
of the design. For this reason, we have performed the Monte the Cadence GPDK 45 nm library to create a buffer chain
Carlo Simulation [93] at the Cadence Virtuoso [94] tool containing 20 buffers and flip-flops to store the buffer outputs
Authorized licensed use limited to: INSTITUTO FEDERAL DO CEARA. Downloaded on January 27,2025 at 13:20:08 UTC from IEEE Xplore. Restrictions apply.
1322 IEEE TRANSACTIONS ON VERY LARGE SCALE INTEGRATION (VLSI) SYSTEMS, VOL. 32, NO. 7, JULY 2024

R EFERENCES
[1] S. E. Quadir et al., “A survey on chip to system reverse engineering,”
ACM J. Emerg. Technol. Comput. Syst., vol. 13, no. 1, pp. 1–34,
Apr. 2016.
[2] M. Tehranipoor and C. Wang, Introduction to Hardware Security and
Trust. Berlin, Germany: Springer, 2011.
[3] S. Skorobogatov, Physical Attacks and Tamper Resistance. New York,
NY, USA: Springer, 2012, pp. 143–173.
[4] Z. Chen, G. Vasilakis, K. Murdock, E. Dean, D. Oswald, and
F. D. Garcia, “VoltPillager: Hardware-based fault injection attacks
against Intel SGX enclaves using the SVID voltage scaling interface,”
in Proc. 30th USENIX Secur. Symp., 2021, pp. 699–716.
Fig. 20. Temperature variation effect on FTC sensor unit buffer cell. [5] M. T. Rahman et al., “Physical inspection & attacks: New frontier in
TABLE III hardware security,” in Proc. IEEE 3rd Int. Verification Secur. Workshop,
Jul. 2018, pp. 93–102.
L ATCHED O UTPUT FOR A B UFFER C HAIN (20 B UFFERS ) W ITH [6] P. Kocher, J. Jaffe, and B. Jun, “Differential power analysis,” in
VARYING S UPPLY VOLTAGE Advances in Cryptology, M. Wiener, Ed. Heidelberg, Germany: Springer,
1999.
[7] P. C. Kocher, “Timing attacks on implementations of Diffie–Hellman,
RSA, DSS, and other systems,” in Advances in Cryptology—CRYPTO,
N. Koblitz, Ed. Berlin, Germany: Springer, 1996.
[8] P. C. Kocher, J. M. Jaffe, and B. C. Jun, “Prevention of side channel
attacks against block cipher implementations and other cryptographic
systems,” U.S. Patent 7 787 620, Aug. 31, 2010.
[9] K. Tiri and I. Verbauwhede, “A logic level design methodology for a
secure DPA resistant ASIC or FPGA implementation,” in Proc. Design,
Automat. Test Europe Conf. Exhib., 2004, pp. 246–251.
considering the TT corner with nominal temperature (25 ◦ C). [10] S. Endo, T. Sugawara, N. Homma, T. Aoki, and A. Satoh, “An on-chip
Table III shows the latched output for supply voltage from the glitchy-clock generator for testing fault injection attacks,” J. Crypto-
rated 1.1 to 0.85 V with a 0.05 V decrease in each step. When graph. Eng., vol. 1, pp. 265–270, Dec. 2011.
[11] N. Timmers, A. Spruyt, and M. Witteman, “Controlling PC on ARM
comparing the latched output with the nominal response with using fault injection,” in Proc. FDTC, 2016, pp. 25–35.
1.1 V, we can see that with each step decrease in the supply [12] M. N. I. Khan and S. Ghosh, “Fault injection attacks on emerging non-
voltage, the string of 1 s becomes smaller and shifts toward volatile memory and countermeasures,” in Proc. HASP, 2018, pp. 1–8.
the LSB. This result can be interpreted as follows. As the [13] M. Dumont, M. Lisart, and P. Maurine, “Electromagnetic fault injection:
voltage level decreases, the input (clock) signal propagates How faults occur,” in Proc. FDTC, 2019, pp. 9–16.
[14] J. G. Van Woudenberg, M. F. Witteman, and F. Menarini, “Practical
slowly through each buffer stage and cannot reach the nth optical fault injection on secure microcontrollers,” in Proc. FDTC, 2011,
buffer at the same clock edge as the nominal case. This trend pp. 91–99.
continues with each step decrease in the supply voltage. If we [15] J. Rodriguez, A. Baldomero, V. Montilla, and J. Mujal, “LLFI: Lateral
continue to decrease the supply voltage, at some point, there laser fault injection attack,” in Proc. FDTC, 2019, pp. 41–47.
will be no 1 s propagated through the buffer chain. From the [16] E.-S. Kim and J.-H. Kim, “Voltage glitch detection circuits and methods
thereof,” U.S. Patent 7 483 328, Jan. 27, 2009.
designer’s perspective, they can calibrate the observable delay [17] C.-Y. Kim, S.-J. Jun, and E.-S. Kim, “Voltage-glitch detection device
stage considering the impact of supply voltage variation of the and method for securing integrated circuit device from voltage glitch
design to achieve consistent output from the sensor. attack,” U.S. Patent 7 085 979, Aug. 1, 2006.
[18] A. G. Yanci, S. Pickles, and T. Arslan, “Characterization of a volt-
age glitch attack detector for secure devices,” in Proc. BLISS, 2009,
V. C ONCLUSION AND F UTURE W ORK pp. 91–96.
In this work, we have proposed a comprehensive solution [19] P. Luo and Y. Fei, “Faulty clock detection for crypto circuits against dif-
ferential fault analysis attack,” IACR Cryptol. ePrint Arch., Tech. Rep.,
for effectively detecting prominent FIAs with a lightweight 2016, no. 2014, p. 967.
on-chip delay-based FTC sensor. From our analysis, we have [20] H. Igarashi, Y. Shi, M. Yanagisawa, and N. Togawa, “Concurrent faulty
found that fault attacks impact the timing of the circuit, and a clock detection for crypto circuits against clock glitch based DFA,” in
sensor capable of tracking the delay changes in a design can Proc. ISCAS, 2013, pp. 1432–1435.
detect the fault conditions. To position the sensor instances [21] P. Luo, C. Luo, and Y. Fei, “System clock and power supply
cross-checking for glitch detection,” IACR Cryptol. ePrint Arch.,
efficiently, we incorporated the SoFI framework for realizing Tech. Rep., 2016, p. 968.
the most vulnerable locations, i.e., registers in the design, and [22] N. Homma et al., “EM attack is non-invasive?—Design methodology
placed those instances closely. We have illustrated the sensor and validity verification of EM attack sensor,” in Cryptographic Hard-
response for the major FIAs, proving that the unified response ware and Embedded Systems—CHES, L. Batina and M. Robshaw, Eds.
from the sensor can clearly distinguish between nominal Berlin, Germany: Springer, 2014.
[23] N. Miura et al., “PLL to the rescue: A novel EM fault countermeasure,”
and fault conditions. We have also performed the overhead in Proc. 53rd ACM/EDAC/IEEE DAC, 2016, pp. 1–6.
analysis, showing minimal resource utilization in the FPGAs. [24] J. Breier, S. Bhasin, and W. He, “An electromagnetic fault injec-
Finally, we explored the sensor response with environmental tion sensor using Hogge phase-detector,” in Proc. 18th ISQED, 2017,
variations, delivering consistent results with process and tem- pp. 307–312.
perature variation. We have characterized the change in buffer [25] W. He, J. Breier, and S. Bhasin, “Cheap and cheerful: A low-cost digital
sensor for detecting laser fault injection attacks,” in Security, Privacy,
outputs based on VD D degradation for the supply voltage and Applied Cryptography Engineering. Berlin, Germany: Springer,
variation. In future work, we intend to utilize the FTC sensor 2016.
in the SoC environment, where we want to relate any irregular [26] D.-G. Lee, D. Choi, J. Seo, and H. Kim, “Reset tree-based optical fault
behavior of SoC modules to the sensor outputs for detecting detection,” Sensors, vol. 13, no. 5, pp. 6713–6729, May 2013.
[27] H. Wang, H. Li, F. Rahman, M. M. Tehranipoor, and F. Farahmandi,
silent data corruption. Additionally, we intend to incorporate “SoFI: Security property-driven vulnerability assessments of ICs against
predictive attack modeling using sensor-generated output to fault-injection attacks,” IEEE Trans. Comput.-Aided Design Integr. Cir-
anticipate abnormal variations that will help prevent FIAs. cuits Syst., vol. 41, no. 3, pp. 452–465, Mar. 2022.
Authorized licensed use limited to: INSTITUTO FEDERAL DO CEARA. Downloaded on January 27,2025 at 13:20:08 UTC from IEEE Xplore. Restrictions apply.
MUTTAKI et al.: FTC: A UNIVERSAL FRAMEWORK FOR FIA DETECTION AND PREVENTION 1323

[28] “FTC—A universal low-overhead fault injection attack detection solu- [55] J. Kaur, A. Sarker, M. M. Kermani, and R. Azarderakhsh, “Hardware
tion,” in Proc. ISTFA. ASM International, 2022, pp. 386–391. constructions for error detection in lightweight welch-gong (WG)-
[29] M. R. Muttaki, T. Zhang, M. Tehranipoor, and F. Farahmandi, “FTC: oriented streamcipher WAGE benchmarked on FPGA,” IEEE Trans.
A universal sensor for fault injection attack detection,” in Proc. IEEE Emerg. Topics Comput., vol. 10, no. 2, pp. 1208–1215, Apr. 2022.
HOST, Jul. 2022, pp. 117–120. [56] K. Aoki et al., “Camellia: A 128-bit block cipher suitable for multiple
[30] A. Barenghi, C. Hocquet, D. Bol, F.-X. Standaert, F. Regazzoni, and platforms—Design andanalysis,” in Selected Areas in Cryptography.
I. Koren, “A combined design-time/test-time study of the vulnerability of Berlin, Germany: Springer, 2001.
sub-threshold devices to low voltage fault attacks,” IEEE Trans. Emerg. [57] M. M. Kermani, R. Azarderakhsh, and J. Xie, “Error detection reliable
Topics Comput., vol. 2, no. 2, pp. 107–118, Jun. 2014. architectures of camellia block cipher applicable to different variants of
[31] L. Zussa, J.-M. Dutertre, J. Clediere, and A. Tria, “Power supply its substitution boxes,” in Proc. AsianHOST, 2016, pp. 1–6.
glitch induced faults on FPGA: An in-depth analysis of the injection [58] H. Cheng and H. M. Heys, “Compact hardware implementation of the
mechanism,” in Proc. IOLTS, 2013, pp. 110–115. block cipher camellia with concurrent error detection,” in Proc. CCECE,
[32] M. Yilmaz, K. Chakrabarty, and M. Tehranipoor, “Test-pattern selection 2007, pp. 1129–1132.
for screening small-delay defects in very-deep submicrometer integrated [59] S. Banik et al., “Midori: A block cipher for low energy,” in
circuits,” IEEE Trans. Comput.-Aided Design Integr. Circuits Syst., Advances in Cryptology—ASIACRYPT. Berlin, Germany: Springer,
vol. 29, no. 5, pp. 760–773, May 2010. 2015, pp. 411–436.
[33] F. Amiel, C. Clavier, and M. Tunstall, “Fault analysis of DPA-resistant [60] W. Cheng, Y. Zhou, and L. Sauvage, “Differential fault analysis on
algorithms,” in Fault Diagnosis and Tolerance in Cryptography. Berlin, midori,” in Information and Communications Security. Berlin, Germany:
Germany: Springer, 2006. Springer, 2016, pp. 307–317.
[34] B. Ning and Q. Liu, “Modeling and efficiency analysis of clock glitch [61] A. Aghaie, M. Mozaffari Kermani, and R. Azarderakhsh, “Fault diag-
fault injection attack,” in Proc. AsianHOST, 2018, pp. 13–18. nosis schemes for low-energy block cipher midori benchmarked on
[35] J.-J. Quisquater and D. Samyde, “Eddy current for magnetic analysis FPGA,” IEEE Trans. Very Large Scale Integr. (VLSI) Syst., vol. 25,
with active sensor,” in Proc. eSMART, 2002, pp. 1–9. no. 4, pp. 1528–1536, Apr. 2017.
[36] J.-M. Schmidt and M. Hutter, “Optical and EM fault-attacks on [62] R. Avanzi, “The QARMA block cipher family,” IACR Trans. Symmetric
CRT-based RSA: Concrete results,” in Proc. Austrochip. Verlag der Cryptol., IACR Cryptol. ePrint Arch., 2016, p. 444.
Technischen Universität Graz, 2007, pp. 61–67. [63] J. Kaur, M. M. Kermani, and R. Azarderakhsh, “Hardware constructions
[37] S. P. Skorobogatov, “Semi-invasive attacks—A new approach to hard- for lightweight cryptographic block cipher QARMA with error detection
ware security analysis,” Comput. Lab., Univ. Cambridge, Cambridge, mechanisms,” IEEE Trans. Emerg. Topics Comput., vol. 10, no. 1,
U.K., Tech. Rep. UCAM-CL-TR-630, 2005. pp. 514–519, Jan. 2022.
[38] M. Agoyan, J.-M. Dutertre, A.-P. Mirbaha, D. Naccache, A.-L. Ribotta, [64] J. Jonas, L. Lamster, A. Kogler, M. Eichlseder, M. Lipp, and D. Gruss,
and A. Tria, “How to flip a bit?” in Proc. IEEE 16th IOLTS, Jul. 2010, “CSI: Rowhammer—Cryptographic security and integrity against
pp. 235–239. rowhammer,” in Proc. IEEE Symp. SP, May 2023, pp. 1702–1718.
[39] R. E. Lyons and W. Vanderkulk, “The use of triple-modular redundancy [65] M. Mozaffari-Kermani and A. Reyhani-Masoleh, “A lightweight concur-
to improve computer reliability,” IBM J. Res. Develop., vol. 6, no. 2, rent fault detection scheme for the AES S-boxes using normal basis,”
pp. 200–209, Apr. 1962. in Cryptographic Hardware and Embedded Systems—CHES. Berlin,
[40] I. Koren and C. M. Krishna, Fault-Tolerant Systems. San Mateo, CA,
Germany: Springer, 2008, pp. 113–129.
USA: Morgan Kaufmann, 2020.
[66] M. Mozaffari-Kermani and A. Reyhani-Masoleh, “A high-performance
[41] A. Dominguez-Oviedo and M. A. Hasan, “Error detection and fault
fault diagnosis approach for the AES subbytes utilizing mixed bases,”
tolerance in ECSM using input randomization,” IEEE Trans. Dependable
in Proc. FDTC, 2011, pp. 80–87.
Secure Comput., vol. 6, no. 3, pp. 175–187, Jul./Sep. 2009.
[67] S. A. Reddy and M. A. Kumar, “Efficient fault detection scheme for
[42] G. Bertoni, L. Breveglieri, I. Koren, and P. Maistri, “An efficient
reliable AES architecture,” in Proc. ICETECT, 2011, pp. 1004–1009.
hardware-based fault diagnosis scheme for AES: Performances and
[68] R. Karri, K. Wu, P. Mishra, and Y. Kim, “Fault-based side-channel
cost,” in Proc. IEEE DFT, Oct. 2004, pp. 130–138.
[43] S. Cha et al., “Defect analysis and cost-effective resilience architecture cryptanalysis tolerant Rijndael symmetric block cipher architecture,” in
for future DRAM devices,” in Proc. IEEE HPCA, Feb. 2017, pp. 61–72. Proc. IEEE DFT, Oct. 2001, pp. 427–435.
[44] U. Kang et al., “Co-architecting controllers and DRAM to enhance [69] Y. Xing and S. Li, “A compact hardware implementation of CCA-secure
DRAM process scaling,” in Proc. Memory Forum, vol. 14, 2014, key exchange mechanism CRYSTALS-KYBER on FPGA,” IACR Trans.
pp. 1–14. Cryptograph. Hardware Embedded Syst., pp. 328–356, Feb. 2021.
[45] N. Kwak et al., “A 4.8 Gb/s/pin 2Gb LPDDR4 SDRAM with [70] PS Process. (2022). Announcing Four Candidates to be
sub-100 µA self-refresh current for IoT applications,” in IEEE Int. Solid- Standardized, Plus Fourth Round Candidates. [Online]. Available:
State Circuits Conf. (ISSCC) Dig. Tech. Papers, Feb. 2017, pp. 392–393. https://csrc.nist.gov/News/2022/pqc-candidates-to-be-standardized-and-
[46] H.-J. Kwon et al., “An extremely low-standby-power 3.733 Gb/s/pin round-4
2Gb LPDDR4 SDRAM for wearable devices,” in IEEE Int. Solid-State [71] P. Ravi, A. Chattopadhyay, J. P. D’Anvers, and A. Baksi, “Side-channel
Circuits Conf. (ISSCC) Dig. Tech. Papers, Feb. 2017, pp. 394–395. and fault-injection attacks over lattice-based post-quantum schemes
[47] M. Patel, G. F. de Oliveira, and O. Mutlu, “HARP: Practically and (Kyber, Dilithium): Survey and new results,” ACM Trans. Embedded
effectively identifying uncorrectable errors in memory chips that use Comput. Syst., vol. 23, no. 2, pp. 1–54, Mar. 2024.
on-die error-correcting codes,” in Proc. MICRO=, 2021, pp. 623–640. [72] H. Ma, S. Pan, Y. Gao, J. He, Y. Zhao, and Y. Jin, “Vulnerable
[48] K. Criss et al., “Improving memory reliability by bounding DRAM PQC against side channel analysis—A case study on Kyber,” in Proc.
faults: DDR5 improved reliability features,” in Proc. MEMSYS, 2020, AsianHOST, 2022, pp. 1–6.
pp. 317–322. [73] T. Fritzmann, T. Poppelmann, and J. Sepulveda, “Analysis of error-
[49] C. Dobraunig, M. Eichlseder, F. Mendel, and M. Schläffer, “Ascon v1.2: correcting codes for lattice-based key exchange,” in Selected Areas in
lightweight authenticated encryption and hashing,” J. Cryptol., vol. 34, Cryptography—SAC 2018: 25th International Conference, Calgary, AB,
no. 3, pp. 1–42, Jul. 2021. Canada, August 15–17, 2018, Revised Selected Papers 25. Springer,
[50] K. Ramezanpour, P. Ampadu, and W. Diehl, “A statistical fault analysis 2019, pp. 369–390.
methodology for the ascon authenticated cipher,” in Proc. IEEE Int. [74] A. Sarker, M. Mozaffari-Kermani, and R. Azarderakhsh, “Hardware
Symp. Hardw. Oriented Secur. Trust (HOST), May 2019, pp. 41–50. constructions for error detection of number-theoretic transform utilized
[51] P. Joshi and B. Mazumdar, “SSFA: Subset fault analysis of ASCON- in secure cryptographic architectures,” IEEE Trans. Very Large Scale
128 authenticated cipher,” Microelectron. Rel., vol. 123, Aug. 2021, Integr. (VLSI) Syst., vol. 27, no. 3, pp. 738–741, Mar. 2019.
Art. no. 114155. [75] A. Sarker, A. C. Canto, M. M. Kermani, and R. Azarderakhsh, “Error
[52] J. Kaur, M. Mozaffari Kermani, and R. Azarderakhsh, “Hardware detection architectures for hardware/software co-design approaches of
constructions for error detection in lightweight authenticated cipher number-theoretic transform,” IEEE Trans. Comput.-Aided Design Integr.
ASCON benchmarked on FPGA,” IEEE Trans. Circuits Syst. II, Exp. Circuits Syst., vol. 42, no. 7, pp. 2418–2422, Jul. 2023.
Briefs, vol. 69, no. 4, pp. 2276–2280, Apr. 2022. [76] H. Wang, Q. Shi, D. Forte, and M. M. Tehranipoor, “Probing assess-
[53] R. AlTawy, G. Gong, K. Mandal, and R. Rohit, “WAGE: An ment framework and evaluation of antiprobing solutions,” IEEE Trans.
authenticated cipher,” Submission to NIST Lightweight Cryptography Very Large Scale Integr. (VLSI) Syst., vol. 27, no. 6, pp. 1239–1252,
Standardization Project, Announced as Round 2 Candidate on August Jun. 2019.
30, 2019, Tech. Rep., 2019. [77] H. Wang, Q. Shi, A. Nahiyan, D. Forte, and M. M. Tehranipoor,
[54] J. Kaur, “Secure lightweight cryptographic hardware constructions for “A physical design flow against front-side probing attacks by internal
deeply embedded systems,” Ph.D. dissertation, Dept. Comput. Sci. Eng., shielding,” IEEE Trans. Comput.-Aided Design Integr. Circuits Syst.,
Univ. South
Authorized Florida,
licensed
vol. 39, 27,2025
2023. to: INSTITUTO FEDERAL DO CEARA. Downloaded on January
use limited
no. 10, at
pp.13:20:08
2152–2165, Oct. 2020.
UTC from IEEE Xplore. Restrictions apply.
1324 IEEE TRANSACTIONS ON VERY LARGE SCALE INTEGRATION (VLSI) SYSTEMS, VOL. 32, NO. 7, JULY 2024

[78] R. Karri, K. Wu, P. Mishra, and Y. Kim, “Concurrent error detection Md Habibur Rahman received the B.Sc. degree in
schemes for fault-based side-channel cryptanalysis of symmetric block EEE from the Bangladesh University of Engineering
ciphers,” IEEE Trans. Comput.-Aided Design Integr. Circuits Syst., and Technology, Dhaka, Bangladesh, in 2017. He is
vol. 21, no. 12, pp. 1509–1517, Dec. 2002. currently working toward the Ph.D. degree at the
[79] M. Mozaffari-Kermani and A. Reyhani-Masoleh, “A lightweight high- University of Florida, Gainesville, FL, USA.
performance fault detection scheme for the advanced encryption standard His research interests include hardware secu-
using composite fields,” IEEE Trans. Very Large Scale Integr. (VLSI) rity, standard cell design in submicrometer Fin-
Syst., vol. 19, no. 1, pp. 85–91, Jan. 2011. FET process, robust memory architecture design,
[80] R. Karri, G. Kuznetsov, and M. Goessel, “Parity-based concurrent error developing novel architectures for digital and ana-
detection of substitution-permutation network block ciphers,” in Cryp- log hardware security verification, optimization of
tographic Hardware and Embedded Systems—CHES. Berlin, Germany: application-specific integrated circuit (ASIC) design
Springer, 2003. verification and physical design, and field programmable gate arrays (FPGAs).
[81] W-Contributors. (2023). Vivado—Wikipedia the Free Encyclopedia. He has proven experience working in both academia and the VLSI industry.
[Online]. Available: https://en.wikipedia.org/wiki/Vivado
[82] S-Solutions. VC Z01X Fault Simulation. Accessed: Oct. 15, 2023. Akshay Kulkarni (Member, IEEE) received the
[Online]. Available: https://www.synopsys.com/verification/simulation/ B.E. degree in electronics and telecommunication
vc-z01x.html from the University of Mumbai, Mumbai, India, and
[83] W-Contributors. (2023). Optimization Problem—Wikipedia the Free the Ph.D. degree from the University of Toledo,
Encyclopedia. [Online]. Available: https://en.wikipedia.org/wiki/ Toledo, OH, USA, in 2020.
Optimization_problem His research interests include microelectronics
[84] W-Contributors. (2023). Integer Programming—Wikipedia the security, with a focus on secure and trusted semi-
Free Encyclopedia. [Online]. Available: https://en.wikipedia.org/ conductor supply chains, hardware-oriented security
wiki/Integer_programming and trust (PUFs), field programmable gate arrays
[85] M. Zhao and G. E. Suh, “FPGA-based remote power side-channel (FPGAs), blockchain technology, and zero trust
attacks,” in Proc. IEEE Symp. SP, May 2018, pp. 229–244. architecture for assured and trusted semiconductors.
[86] F. Schellenberg, D. R. E. Gnad, A. Moradi, and M. B. Tahoori, He is currently serving as a Postdoctoral Research Associate with the
“An inside job: Remote power analysis attacks on FPGAs,” IEEE Des. University of Florida, Gainesville, FL, USA.
Test, vol. 38, no. 3, pp. 58–66, Jun. 2021.
[87] C. Dobraunig, M. Eichlseder, T. Korak, S. Mangard, F. Mendel, and Mark Tehranipoor (Fellow, IEEE) is currently the
R. Primas, “SIFA: Exploiting ineffective fault inductions on symmet- Intel Charles E. Young Preeminence Endowed Chair
ric cryptography,” IACR Trans. Cryptograph. Hardw. Embedded Syst., Professor of Cybersecurity with the University of
vol. 2018, no. 3, pp. 547–572, Aug. 2018. Florida, Gainesville, FL, USA. His current research
[88] LET. (2015). E1 Set: Immunity Development System. [Online]. Available: projects include hardware security and trust, supply
https://www.langer-emv.de/en/product/immunity-development- chain security, the Internet of Things (IoT) security,
system/68/e1-set-immunity-development-system/54 VLSI design, test, and reliability.
[89] (2023). Riscure Laser Station 2. [Online]. Available: https://www. Dr. Tehranipoor is a fellow of ACM, a Golden
riscure.com/products/laser-station-2/ Core Member of IEEE CS, and a member of ACM
[90] B. Selmke, S. Brummer, J. Heyszl, and G. Sigl, “Precise laser fault SIGDA. He was a recipient of a dozen best paper
injections into 90 nm and 45 nm SRAM-cells,” in Smart Card Research awards and nominations, as well as the 2008 IEEE
and Advanced Applications, vol. 9514. Berlin, Germany: Springer, 2015. Computer Society (CS) Meritorious Service Award, the 2012 IEEE CS
[91] G. Canivet, P. Maistri, R. Leveugle, J. Clédière, F. Valette, and Outstanding Contribution, the 2009 NSF CAREER Award, the 2014 AFOSR
M. Renaudin, “Glitch and laser fault attacks onto a secure AES imple- MURI Award, and the 2020 University of Florida Innovation of the Year
mentation on a SRAM-based FPGA,” J. Cryptol., vol. 24, no. 2, as well as teacher/scholar of the year awards. He co-founded the IEEE
pp. 247–268, Apr. 2011. International Symposium on Hardware-Oriented Security and Trust (HOST)
[92] W-Contributors. (2023). RISC-V—Wikipedia the Free Encyclopedia. and IEEE International Conference on Physical Assurance and Inspection
[Online]. Available: https://en.wikipedia.org/wiki/RISC-V of Electronics (PAINE). He serves on the program committee of more
[93] W-Contributors. (2023). Monte Carlo Method—Wikipedia the Free than a dozen leading conferences and workshops. He has also served as
Encyclopedia. [Online]. Available: https://en.wikipedia.org/wiki/Monte_ Program and General Chair of several IEEE and ACM-sponsored conferences
Carlo_method and workshops (HOST, ITC, DFT, D3T, DBT, NATW, and more). He is
[94] CCI Design Tools. Virtuoso Schematic Editor. Accessed: Sep. 22, 2023. currently serving as a founding EIC for Journal on Hardware and Systems
[Online]. Available: https://www.cadence.com/en_US/home/tools/ Security (HaSS) and served as Associate Editor for IEEE T RANSACTIONS ON
custom-ic-analog-RF-design/circuit-design/virtuoso-schematic- C OMPUTERS (TC), Journal of Electronic Testing: Theory and Applications
editor.html (JETTA), Journal of Low Power Electronics (JOLPE), ACM Transactions on
[95] M. Sadi and M. Tehranipoor, “Design of a network of digital sensor Design Automation of Electronic Systems (TODAES), IEEE D ESIGN AND
macros for extracting power supply noise profile in SoCs,” IEEE Trans. T EST (D&T), and IEEE TVLSI). He is currently serving as a Founding
Very Large Scale Integr. (VLSI) Syst., vol. 24, no. 5, pp. 1702–1714, Director for the Florida Institute for Cybersecurity Research (FICS) and
May 2016. several other centers with a focus on microelectronics security.
[96] R. Kumar and V. Kursun, “Reversed temperature-dependent propagation
delay characteristics in nanometer CMOS circuits,” IEEE Trans. Circuits Farimah Farahmandi (Member, IEEE) received the
Syst. II, Exp. Briefs, vol. 53, no. 10, pp. 1078–1082, Oct. 2006. Ph.D. degree from the Department of Computer and
Information Science and Engineering (CISE), Uni-
versity of Florida, Gainesville, FL, USA, in 2018.
She is currently an Assistant Professor with the
Department of Electrical and Computer Engineering
Md Rafid Muttaki (Member, IEEE) received the (ECE) and the Associate Director of Edaptive Com-
B.Sc. degree from the Department of Electrical and puting Inc., Transition Center (ECITC), University
Electronic Engineering (EEE), Bangladesh Univer- of Florida. Her research interests include hardware
sity of Engineering and Technology (BUET), Dhaka, security verification, formal methods, fault-injection
Bangladesh, in 2017, and the M.Sc. degree from the attack analysis, side-channel leakage assessment,
Department of Electrical and Computer Engineer- secure supply chain of microelectronics, and post-silicon validation and
ing (ECE), University of Florida, Gainesville, FL, debugging. Her research has resulted in four books, nine book chapters, and
USA, in 2023, where he is currently working toward several publications in premier ACM/IEEE journals and conferences. Her
the Ph.D. degree. research has been sponsored by SRC, DARPA, AFRL, DoD, Analog Devices,
His research interests include high-level synthesis ANSYS, and Cisco.
vulnerabilities assessment and possible solutions and Dr. Farahmandi is a member of ACM. She currently serves as an Associate
High-level obfuscation in the digital domain. In the analog domain, he has Editor of IET Computers & Digital Techniques. She also has served on many
been working on developing analog IP protection techniques consisting of technical program committees as well as organizing committees of premier
analog obfuscation and watermarking, AMS design security assessment, and ACM and IEEE conferences such as being the vice-program chair of IEEE
universal sensor-based solution against physical attacks. HOST.
Authorized licensed use limited to: INSTITUTO FEDERAL DO CEARA. Downloaded on January 27,2025 at 13:20:08 UTC from IEEE Xplore. Restrictions apply.