A utilização de várias ferramentas de injeção de falhas em um mesmo experimento de testes fornece mais subsídios para os resultados alcançados, tornando a atividade mais efetiva e menos sujeita a erros de interpretação. Neste sentido, as cargas de falhas possuem um importante papel, visto que elas compõem a principal entrada a ser fornecida nestas ferramentas. No entanto, os mecanismos oferecidos, nas ferramentas de injeção de falhas existentes, para esta especificação de cargas de falhas, possuem um baixo grau de usabilidade e expressividade. Por este motivo, o presente trabalho aborda uma metodologia, na qual cenários detalhados de testes, que envolvam experimentos com injeção de falhas, possam ser especificados de maneira simples, homogênea e padronizada. Para isso, é proposta a criação de um ambiente para a especificação destas cargas de falhas, denominado como jFaultload. Este ambiente, por sua vez, utiliza-se de um subconjunto da linguagem Java para a especificação destas cargas de falhas, ficando responsável ainda pela tradução, desta carga em Java, para os respectivos formatos de carga referentes a cada injetor de falhas utilizado em um dado experimento. Para efeito de exemplo e validação do ambiente proposto, as ferramentas FIRMAMENT, MENDOSUS e FAIL/FCI são integradas neste ambiente, tornando assim o cenário de testes amplamente detalhado. O serviço a ser testado, visando a demonstração da usabilidade e expressividade da solução proposta, foi uma sessão de video streaming, utilizando-se para isso do protocolo RTP, onde uma campanha de testes foi realizada com o injetor FIRMAMENT. / Use of two or more fault injection tools in a test campaign enriches the scenario obtained from a test execution. Faultloads represent the main input for these tools but their specification mechanisms lack usability and expressiveness. This thesis presents a full test scenario featuring the use of jFaultload, which applies Java for the specification of faultloads and translates them to specific formats that are appropriate to each available fault injector. FIRMAMENT, MENDOSUS and FAIL/FCI, fault injectors for communication systems, were integrated in the environment and complete the test scenario. The service under test used to demonstrate the usability and expressiveness of our solution is a video streaming session using RTP Protocol, which a test campaign was executed through the FIRMAMENT fault injector.

O recente avanço da indústria de semicondutores tem possibilitado a integração de componentes complexos e arquiteturas de sistemas dentro de um único chip de silício. Atualmente, FPGAs do estado da arte incluem, não apenas a matriz de lógica programável, mas também outros blocos de hardware, como processadores de propósito geral, blocos de processamento dedicado, interfaces para vários periféricos, estruturas de barramento internas ao chip, e blocos analógicos. Estes novos dispositivos são comumente chamados de Sistemasem-Chip Totalmente Programáveis (APSoCs). Uma das maiores preocupações acerca dos efeitos da radiação em APSoCs é o fato de que erros induzidos pela radiação podem ter diferente probabilidade e criticalidade em seus blocos de hardware heterogêneos, em ambos os níveis de dispositivo e projeto. Por esta razão, este trabalho realiza uma investigação profunda acerca dos efeitos da radiação em APSoCs e da correlação entre a sensibilidade de recursos de hardware e software na performance geral do sistema. Diversos experimentos estáticos e dinâmicos inéditos foram realizados nos blocos de hardware de um APSoC a fim de melhor entender as relações entre confiabilidade e performance de cada parte separadamente. Os resultados mostram que há um comprometimento a ser analisado entre o desempenho e a área de choque de um projeto durante o desenvolvimento de um sistema em um APSoC. Desse modo, é fundamental levar em consideração cada opção de projeto disponível e todos os parâmetros do sistema envolvidos, como o tempo de execução e a carga de trabalho, e não apenas a sua seção de choque. Exemplificativamente, os resultados mostram que é possível aumentar o desempenho de um sistema em até 5.000 vezes com um pequeno aumento na sua seção de choque de até 8 vezes, aumentando assim a confiabilidade operacional do sistema. Este trabalho também propõe um fluxo de análise de confiabilidade baseado em injeções de falhas para estimar a tendência de confiabilidade de projetos somente de hardware, de software, ou de hardware e software. O fluxo objetiva acelerar a procura pelo esquema de projeto com a melhor relação entre performance e confiabilidade dentre as opções possíveis. A metodologia leva em consideração quatro grupos de parâmetros, os quais são: recursos e performance; erros e bits críticos; medidas de radiação, tais como seções de choque estáticas e dinâmicas; e, carga de trabalho média entre falhas. Os resultados obtidos mostram que o fluxo proposto é um método apropriado para estimar tendências de confiabilidade de projeto de sistemas em APSoCs antes de experimentos com radiação. / The recent advance of the semiconductor industry has allowed the integration of complex components and systems’ architectures into a single silicon die. Nowadays, state-ofthe-art FPGAs include not only the programmable logic fabric but also hard-core parts, such as hard-core general-purpose processors, dedicated processing blocks, interfaces to various peripherals, on-chip bus structures, and analog blocks. These new devices are commonly called of All Programmable System-on-Chip (APSoC) devices. One of the major concerns about radiation effects on APSoCs is that radiation-induced errors may have different probability and criticality in their heterogeneous hardware parts at both device and design levels. For this reason, this work performs a deep investigation about the radiation effects on APSoCs and the correlation between hardware and software resources sensitivity in the overall system performance. Several static and dynamic experiments were performed on different hardware parts of an APSoC to better understand the trade-offs between reliability and performance of each part separately. Results show that there is a trade-off between design cross section and performance to be analyzed when developing a system on an APSoC. Therefore, today it is mandatory to take into account each design option available and all the parameters of the system involved, such as the execution time and the workload of the system, and not only its cross section. As an example, results show that it is possible to increase the performance of a system up to 5,000 times by changing its architecture with a small impact in cross section (increase up to 8 times), significantly increasing the operational reliability of the system. This work also proposes a reliability analysis flow based on fault injection for estimating the reliability trend of hardware-only designs, software-only designs, and hardware and software co-designs. It aims to accelerate the search for the design scheme with the best trade-off between performance and reliability among the possible ones. The methodology takes into account four groups of parameters, which are the following: area resources and performance; the number of output errors and critical bits; radiation measurements, such as static and dynamic cross sections; and, Mean Workload Between Failures. The obtained results show that the proposed flow is a suitable method for estimating the reliability trend of system designs on APSoCs before radiation experiments.

A busca por características de dependabilidade em aplicações distribuídas está cada vez maior. Para tanto, técnicas de tolerância a falhas são componentes importantes no processo de desenvolvimento de um software, e requerem a reprodução de cenários espe- cíficos de falhas para possibilitar uma avaliação adequada. Nestes casos, resta ao engenheiro de teste a integração de experimentos da aplicação- alvo com ferramentas auxiliares para emulação de um ambiente fiel para a execução de testes. Entretanto, tais ferramentas auxiliares, designadas injetores de falhas de comuni- cação, muitas vezes não estão disponíveis para a comunidade ou, na melhor das hipóteses, apresentam baixa funcionalidade, seja pela incompatibilidade com sistemas mais atuali- zados, seja pela implementação superficial de funções específicas (protótipos). Outro fator agravante para a realização de avaliações experimentais em aplicações distribuídas está no suporte a falhas distribuídas, ou seja, injetores de falhas de comunica- ção não, obrigatoriamente, estão aptos a reproduzir os comportamentos necessários para emulação de ambientes distribuídos adequados. Desta forma, este trabalho destina-se ao estudo e proposta de uma solução para injeção de falhas em ambientes distribuídos, em especial o particionamento de rede, e deu origem ao injetor de falhas PIE. PIE (Partitioning Injection Environment) é um injetor de falhas de comunicação vol- tado para injeção de particionamentos de rede. Sua arquitetura distribuída permite o con- trole centralizado do ambiente por parte do engenheiro de testes. Com isso, a criação de uma única carga de falhas pode ser facilmente replicada para os demais nodos componen- tes do ambiente experimental. Apesar de adotar um coordenador de experimentos, durante a execução de testes, cada nodo interpreta sua carga de falhas e processa-a localmente, ga- rantindo a baixa intrusividade da ferramenta e evitando a ocorrência de comportamentos inesperados pela aplicação-alvo. Como mecanismo de avaliação desta proposta foram realizados experimentos com diferentes aplicações-alvo, disponibilizadas pelo framework JGroups, com um conjunto de cenários de falha específico para cada aplicação. Desta forma, foi possível comprovar a viabilidade e utilidade do modelo e arquitetura do injetor de falhas PIE levando em consideração sua funcionalidade, intrusividade e corretude dos resultados experimentais. / Communication Fault Injection in Distributed Environments The search for dependability characteristics in distributed applications is increasing quickly. For these, fault tolerance techniques are important components in software de- velopment and requires the emulation of specific scenarios to allow a proper evaluation. In these cases, it remains to the test managers the integration of the target application with extra tools for a faithful emulation environment. However, such tools, named com- munication fault injectors, are not available to the community or, in other cases, presents a very poor functionality, incompatibility with current systems, either by superficial im- plementation of specific functions (prototypes). Another problem for achieving experimental evaluations in distributed applications is the support to distributed faults. Communication fault injectors not necessarily are able to reproduce the behaviors required for proper environment emulation. Thus, this work aims to study and propose a solution for fault injection in distributed environments in particular network partitioning, and led to PIE fault injector. PIE (Partitioning Injection Environment) is a communication fault injector aimed to network partitioning injection. Its distributed architecture allows centralized control by the test manager. Thus, a fault load can be easily replicated to other nodes. Despite adopting a experiment coordinator, each node interprets its fault load and processes it locally during testing, ensuring PIE low intrusiveness and avoiding the occurrence of unexpected behavior by the target application. As an assessment of this work, experiments were done with different target appli- cations, provided by JGroups framework, with a set of specific fault scenarios to each application. Thus, it was able to prove the feasibility and usefulness of the model and architecture of the PIE fault injector considering its functionality, intrusiveness and cor- rectness of the experimental results.

Thesis (M.Sc.Eng.) PLEASE NOTE: Boston University Libraries did not receive an Authorization To Manage form for this thesis or dissertation. It is therefore not openly accessible, though it may be available by request. If you are the author or principal advisor of this work and would like to request open access for it, please contact us at open-help@bu.edu. Thank you. / In this thesis, we firstly present the secure multipliers protected by the AMD codes, and demonstrate that the fault masking probabilities are not worse than the results based on the theoretical analysis of error masking probabilities, if the attacker injects faults at outputs of the inside logic gates of the protected devices. Single-errorcorrecting, double-error-detecting (SEC-DED) codes are widely used for the design of errors, thus they are not suitable for memories used in cryptographic devices. Algebraic Manipulation Detection (AMD) codes provide strong protection against fault injection attacks. But traditional AMD codes can not be used for correcting errors. In this thesis, we also present the constructions of the strongly secure algebraic manipulation correction (AMC) codes. The estimation for a probability for miscorrection of multiple errors is given. Hardware implementations of strongly secure SEC-DED memories based on the proposed codes are presented. Comparison with other codes which have been used for SEC-DED memories with security or weak security are given in terms of numbers of undetected errors, sizes of security kernels and miscorrection probabilities as well as latency, area and power consumption for encoders and decoders. An error handling method to distinguish between random errors and fault injection attacks is presented as well. The proposed code can be applied to most secure-critical memories in cryptographic devices. As far as we know, this is the only efficient approach to provide both high reliability for single and double random errors, and high security for strong fault attack when an attacker has a control of both on the messages (outputs of the memories) and the errors. / 2031-01-01

SRAM-Based FPGAs provide valuable computation resources and reconfigurability; however, FPGA designs can fail during operation due to ionizing radiation. As an SRAM-based device, these FPGAs store operation-critical information in configuration RAM, or CRAM. Testing, through radiation tests, can be performed to prove the effectiveness of SEU mitigation techniques by comparing the SEU sensitivity of an FPGA design with and without the mitigation techniques applied. However, radiation testing is expensive and time-consuming. Another method for SEU sensitivity testing is through fault injection. This work describes a low-cost fault injection platform for evaluating the SEU sensitivity of an SRAM-based FPGA design by emulating faults in the device CRAM through partial reconfiguration. This fault injection platform, called the TURTLE, is designed to gather statistically significant amounts of fault injection data to test and validate SEU mitigation techniques for SRAM-based FPGAs. Across multiple fault injection campaigns, the TURTLE platform was used to inject more than 600 million faults to test SEU mitigation techniques, estimate design SEU sensitivity, and validate radiation test data through fault injection.

La robustesse est un attribut spécifique de la fiabilité qui caractérise la réaction d’un système aux fautes externes. Par conséquent, le test de robustesse consiste à tester un système en présence de fautes ou dans des conditions environnementales stressantes afin d’étudier son comportement lorsqu’il évolue dans un environnement hostile. Le test de robustesse peut être soit empirique ou formel. Les méthodes d’injection de fautes sont très communément utilisées pour évaluer le degré de robustesse d’un système. Cependant, elles ne se basent sur aucun oracle de test pour valider leurs résultats. D’autre part, les méthodes formelles de test de robustesse formalisent et la génération de fautes et le processus d’analyse. Elles présentent cependant quelques limitations par rapport aux types de fautes considérées qui dépendent fortement du modèle fonctionnel du système testé. Le travail que nous présentons dans cette thèse, consiste en un ensemble de propositions qui ont pour objectif de répondre aux défis auxquels font face les approches de test de robustesse existantes. D’abord, nous proposons une approche formelle pour la spécification et la vérification du processus d’injection de fautes. Cette approche consiste à formaliser les fautes injectées par un ensemble de triplet de Hoare et ensuite d’utiliser cette spécification pour vérifier la bonne exécution des campagnes d’injections. Notre seconde contribution concerne la spécification et la vérification des propriétés de robustesse. Nous proposons de formaliser les propriétés de robustesse en utilisant une extension de la logique temporelle linéaire qui permet la spécification de contraintes temps réel (XCTL) et nous proposons un algorithme de test passif qui permet de tester la satisfiabilité de ce type de contraintes sur des traces d’exécution finies. Nous contribuons aussi par une nouvelle approche de test de robustesse. Nous proposons une approche hybride basée sur l’injection de fautes et le test passif. L’injection de fautes est utilisée pour créer des conditions environnementales stressantes, et le test passif permet de vérifier la satisfiabilité des propriétés de robustesse sur les traces d’exécution collectées. Les fautes injectées ainsi que les propriétés de robustesse sont formellement spécifiées. Nous utilisons la logique de Hoare pour la spécification des fautes et la logique XCTL pour la formalisation des propriétés de robustesse. Ce qui nous permet de vérifier à la fois le processus d’injection et les exigences de robustesse en appliquant les approches de test passives proposées dans nos contributions précédentes. Finalement, nous proposons une plateforme de modélisation et de vérification de la robustesse des services Web. Cette plateforme est en réalité une instanciation de notre approche de test de robustesse, adaptée aux services Web. Le choix des services Web est motivé par l’émergence de cette technologie qui tend progressivement à s’imposer comme un standard du paradigme de communication programme-à-programme. Ils fournissent aussi un excellent exemple de systèmes hétérogènes fortement distribués. / Robustness is a specialized dependability attribute, characterizing a system reaction with respect to external faults. Accordingly, robustness testing involves testing a system in the presence of faults or stressful environmental conditions to study its behavior when facing abnormal conditions. Testing system robustness can be done either empirically or formally. Fault injection techniques are very suitable for assessing the robustness degree of the tested system. They do not rely however, on formal test oracles for validating their test. On the other hand, existing formal approaches for robustness testing formalize both the fault generation and the result analysis process. They have however some limitations regarding the type of the handled faults as well as the kind of systems on which they can be applied. The work presented in this thesis manuscript aims at addressing some of the issues of the existing robustness testing methods. First, we propose a formal approach for the specification and the verification of the fault injection process. This approach consists in formalizing the injected faults as a set of Hoare triples and then, verifying the good execution of the injection campaigns, based on a passive testing algorithm that checks the fault specification against a collected injection trace. Our second contribution focuses on providing a test oracle for verifying real time constraints. We propose a passive testing algorithm to check real time requirements, specified as a set of XCTL (eXplicit Clock Temporal Logic) formulas, on collected execution traces. Then, we propose a new robustness testing approach. It is a complementary approach that combines fault injection and passive testing for testing system robustness. The injected faults are specified as a set of Hoare triples and verified against the injection trace to validate the injection process. The robustness requirements are formalized as a set of XCTL formulas and are verified on collected execution traces. This approach allows one to inject a wide range of faults and can be used to test both simple and distributed systems. Finally, we propose an instantiation of our robustness testing approach for Web services. We chose Web services technology because it supports widely distributed and heterogeneous systems. It is therefore, a very good application example to show the efficiency of our approach.

Safety and mission critical systems are currently deployed in many different fields where there is a greater presence of high energy particles (e.g.\ aerospace). The use of field programmable gate arrays (FPGAs) within safety critical systems is becoming more prevalent due to the design and cost benefits their use provides. The effects of externally caused faults on these safety critical systems cannot be neglected. In particular, high energy particle striking a circuit can cause a voltage change in the circuit known as a soft error. The effects these soft errors will have on the circuit needs to be understood in order to ensure that the systems will function properly in the event soft errors do occur. In this thesis a tool is designed to facilitate the run-time injection of soft errors into a hardware circuit running on a FPGA. The tool allows for the control over the number of injections that can be performed and control over the rate that the injections will occur at. Additionally the tool records time stamps of when injections occur and time stamps of when errors are detected. This recorded data allows for the analysis of designs in conditions prone to soft errors. The implemented tool allows for design time parametrization and run time configuration, allowing a multitude of tests to be run for a single compiled design. The tool also eliminates the need for a host computer after configuration by generating the injection locations and times on the FPGA. Eliminating the host computer allows for faster testing when compared to other methods as data transfer times are greatly reduced. The implemented tool was run on classical examples of redundant structures, such as duplication with comparison and triple modular redundancy as well as a non-redundant structure to establish a baseline. The results of multiple tests run on each structure are analyzed to illustrate the uses of the tool and how the tool may be used to test other designs. / Thesis / Master of Applied Science (MASc)

As embedded systems continue to evolve and the number of applications they support continues to increase, so does the diversity of the hardware they employ. As a result, the Field Programmable Gate Arrays (FPGAs), which have become fundamental elements in their design, have advanced in size and complexity as well. Because of this, it is now impossible to ignore the security implications that accompany such a progression. It is then not only important to prevent malicious attacks targeted at FPGAs from extracting the intellectual property contained in their configuration, but to now extend the research in this field by providing a cross-platform solution capable of securing the integrity of FPGA configurations at run-time. Today, there exist myriad attack strategies employed against FPGAs, the majority of which are seen in the form of semi-invasive attacks. These attacks manipulate the configuration of an FPGA and typically modify the state of the transistors that make up said configuration. This thesis introduces a multi-platform method for checking the integrity of an FPGA's configuration. The details of the system's design and implementation are discussed in addition to the analysis of the design trade-offs met when employing the system across multiple FPGA families. The system is implemented entirely in hardware and resides on-chip, providing an FPGA the ability to act as private entity capable of successfully detecting when it has been maliciously attacked. / Master of Science

In our daily life, we are increasingly putting our trust in embedded software applications, which run on a range of processor-based embedded systems from smartcards to pay-TV units. This trend expands the threat model of embedded applications from software into hardware. Over the last 20 years, fault attacks have emerged as an important class of hardware attacks against embedded software security. In fault attacks, an adversary breaks the security by injecting well chosen, targeted faults during the execution of embedded software, and systematically analyzing softwares fault response. In this work, we propose cycle-accurate and fully digital techniques that can efficiently detect different types of fault attacks. The detection methods are low-cost regarding the area and power consumption and can be easily implemented using the standard cell based VLSI design flow. In addition to the architecture of the detectors, we present a detailed analysis of the design considerations that affect the cost and accuracy of the detectors. The functionality of the detectors is validated by implementing on ASIC and FPGA platforms (Spartan-6, Cyclone IV). Additionally, the proposed detection methods have demonstrated to successfully detect all of the injected faults without any false alarm. / Master of Science

The complexity of safety-related embedded computer systems is steadilyincreasing. Besides verifying that such systems implement the correct functionality, it is essential to verify that they also present an acceptable level of robustness. Robustness is in this thesis defined as the resilience of hardware, software or systems against errors that occur during runtime. One way of performing robustness assessment is to carry out fault injection, also known as fault insertion testing from certain safety standards. The idea behind fault injection is to accelerate the occurrence of faults in the system to evaluate its behavior under the influence of anticipated faults, and to evaluate error handling mechanisms. Model-based development is becoming more and more common for the development of safety-related software. Thus, in this thesis we investigate how we can benefit from conducting fault injection experiments on behavior models of software. This is defined as model-implemented fault injection in this thesis, since additional model artifacts are added to support the injection of faults that are activated during simulation. In particular, this thesis addresses injection of hardware fault effects (e.g. bit-level errors in microcontrollers) into Simulink® models. To evaluate the method, a fault injection tool has been developed (called MODIFI), that is able to perform fault injection into Simulink behavior models. MODIFI imports tailored fault libraries that define the effects of faults according to an XML-schema. The fault libraries are converted into executable model blocks that are added to behavior models and activated during runtime to emulate the effect of faults. Further, we use a method called minimal cut sets generation to increase the usefulness of the tool. During the work within MOGENTES, an EU 7th framework programme project that focused on model-based generation of test cases for dependable embedded systems, fault injection experiments have been performed on safety related models with the MODIFI tool. Experiments were also performed using traditional fault injection methods, and in particular hardware-implemented fault injection, to evaluate the correlation between the methods. The results reveal that fault injection on software models is efficient and useful for robustness assessment and that results produced with MODIFI appear to be representative for the results obtained with other fault injection methods. However, a software model suppresses implementation details, thus leading to fewer locations where faults can be injected. Therefore it cannot entirely replace traditional fault injection methods, but by performing model-implemented fault injection in early design phases an overview of the robustness of a model can be obtained, given these limitations. It can also be useful for testing of error handling mechanisms that are implemented in the behavior model. / QC 20111205