Dans le domaine des cartes à puce, les analyses de vulnérabilité demandent d’être à la pointe de l’art en termes d’attaques et de techniques de protection. Une attaque classique est l’injection de fautes, réalisée au niveau matériel notamment par des techniques laser. Pour anticiper les impacts possibles de ce type d'attaque, certaines analyses sont menées au niveau logiciel. Il est donc fortement d’actualité de pouvoir définir des critères et proposer des outils automatiques permettant d’évaluer la robustesse d’une application à ce type d’attaque, d’autant plus que les techniques d’attaques matérielles permettent maintenant d’enchaîner plusieurs attaques (spatiales ou temporelles) au cours d’une exécution. En effet, des travaux de recherche récents évaluent l'impact des contre-mesures face à ce type d'attaque[1], ou tentent de modéliser les injections de faute au niveau C[2]. Le sujet de thèse proposé s'inscrit dans cette problématique, avec néanmoins la particularité novatrice de s'intéresser au couplage des analyses statique et dynamique dans le cas des injections de fautes effectuées au niveau binaire. Un des objectifs de la thèse est d'offrir un cadre paramétrable permettant de simuler des attaques par faute telles qu'elles peuvent être réalisées par le laboratoire CESTI-LETI au niveau matériel. Il faudra donc proposer un modèle intermédiaire générique permettant de spécifier des contraintes réelles comme par exemple les différents types de mémoires (RAM, EEPROM, ROM), qui peuvent induire des fautes permanentes ou volatiles. Concilier les analyses statiques du code et l'injection de fautes dynamiques devra permettre de maîtriser la combinatoire des exécutions et de guider l'analyse à l'aide de patterns d'attaques. À ce titre, on sera amené à proposer une taxonomie des attaques et de nouvelles modélisations d'attaques. Il faudra également adapter les outils d'analyse statique aux conséquences de l'injection dynamique de fautes, qui peut modifier profondément le code en changeant l'interprétation des instructions, ce qui a un effet similaire à la génération de code à l'exécution. Ce sujet de thèse s'inscrit dans la stratégie d'innovation du CESTI-LETI et pourra aboutir à un vérificateur automatique de code utilisable par les évaluateurs du CESTI-LETI. [1] A. Séré, J-L. Lanet et J. Iguchi-Cartigny. « Evaluation of Countermeasures Against Fault Attacks on Smart Cards ». en. In : International Journal of Security and Its Applications 5.2 (2011). [2] Xavier Kauffmann-Tourkestansky. « Analyses sécuritaires de code de carte à puce sous attaques physiques simulées ». Français. THESE. Université d’Orléans, nov. 2012. url : http://tel.archives-ouvertes.fr/tel-00771273. / Vulnerability detections for smart cards require state of the art methods both to attack and to protect the secure device. A typical type of attack is fault injection, most notably performed by means of laser techniques. To prevent some of the consequences of this kind of attacks, several analyses are conducted at the software level. Being able to define criteria and to propose automated tools that can survey the robustness of an application to fault injection is thus nowadays a hot topic, even more so since the hardware attack techniques allow today an attacker to perform several attacks in a single software execution. Indeed, recent research works evaluate the effectiveness of counter-measures against fault injection[1], or attempt to develop models of fault injection at the C level[2]. This thesis project addresses the issue of multiple faults injection, albeit by adding the distinctive aspect of static and dynamic analysis interaction in a context of binary-level fault injection. An objective of the thesis is to achieve a configurable framework to simulate fault injections in the way they are currently performed by the CESTI-LETI laboratory on the actual hardware. To do so we will develop a generic intermediate model that will allow us to specify hardware constraints, such as the various kinds of memories (RAM, EEPROM, ROM), whose different properties can induce either permanent or volatile faults. Combining the static code analysis with dynamic fault injections should prevent the combinatory explosion of the executiions while attack patterns will guide the analysis. A taxonomy of attacks and new attack modelisations could emerge from this work. An adaption of the tools for static analysis is also required, because dynamic fault injection can deeply change the code by modifying the interpretation of the instructions, in a similar manner to dynamic compilation. This thesis project falls within the CESTI-LETI's innovation strategy, et could lead to an automated code verifier that could be used by the CESTI-LETI evaluation specialists. [1] A. Séré, J-L. Lanet et J. Iguchi-Cartigny. « Evaluation of Countermeasures Against Fault Attacks on Smart Cards ». en. In : International Journal of Security and Its Applications 5.2 (2011). [2] Xavier Kauffmann-Tourkestansky. « Analyses sécuritaires de code de carte à puce sous attaques physiques simulées ». Français. THESE. Université d’Orléans, nov. 2012. url : http://tel.archives-ouvertes.fr/tel-00771273.

Orientador: Gilberto Pechoto de Melo / Banca: Vicente Lopes Júnior / Banca: Raquel Santini Leandro Rade / Resumo: Hoje em dia um dos fatores de interesse das indústrias no desenvolvimento de novas técnicas de detecção e localização de falhas é a preocupação com a segurança de seus sistemas, tendo-se a necessidade de supervisão e monitoramento de modo que as falhas sejam detectadas e corrigidas o mais rápido possível. Verifica-se na prática que determinados parâmetros dos sistemas podem variar durante o processo, devido a características específicas ou o desgaste natural de seus componentes. Sabe-se também que, mesmo nos sistemas bem projetados, a ocorrência de trincas em alguns componentes pode provocar perdas econômicas ou conduzir a situações perigosas. Os observadores de estado podem reconstruir os estados não medidos do sistema, desde que os mesmos sejam observáveis, tornando possível, desta forma, estimar as medidas nos pontos de difícil acesso. A técnica dos observadores de estado consiste em desenvolver um modelo para o sistema em análise e comparar a estimativa da saída com a saída medida, a diferença entre os dois sinais presentes resulta em um resíduo que é utilizado para análise. Neste trabalho foi montado um banco de observadores associado a um modelo de trinca de modo a acompanhar o progresso da mesma. Os resultados obtidos através de simulações computacionais em uma placa engastada discretizada pela técnica dos elementos finitos e as análises experimentais realizadas foram bastante satisfatórios, validando a metodologia desenvolvida. / Abstract: Nowadays a main factor of interest in industries in the development of new techniques for detection and localization of faults is the concern with the security of its systems. There is the need of supervising and monitoring the machines to detect and correct the fault as soon as possible. In practice it is verified that some determined parameters of the systems can vary during the process, due to the specific characteristics or the natural wearing of its components. It is known that even in well-designed systems the occurrence of cracks in some components can induce economic losses or lead to dangerous situations. The state observers methodology can reconstruct the unmeasured states of the system, since they are observable, becoming possible in this way to estimate the measures at points of difficult access. The technique of state observers consists of developing a model for the system under analysis and to compare the estimated with the measured exit, and the difference between these two signals results in a residue that is used for analysis. In this work was set up a bank of observers associated to a model of crack in order to follow its progress. The results obtained through computational simulations in a cantilever plate discretized by using the finite elements technique and the accomplished experimental analysis were sufficiently satisfactory, validating the developed methodology. / Mestre

Made available in DSpace on 2014-06-11T19:27:14Z (GMT). No. of bitstreams: 0 Previous issue date: 2008-04-19Bitstream added on 2014-06-13T18:55:45Z : No. of bitstreams: 1 zacarias_at_me_ilha.pdf: 587117 bytes, checksum: 4a907603292d52ff41cf7df3b7718be5 (MD5) / Hoje em dia um dos fatores de interesse das indústrias no desenvolvimento de novas técnicas de detecção e localização de falhas é a preocupação com a segurança de seus sistemas, tendo-se a necessidade de supervisão e monitoramento de modo que as falhas sejam detectadas e corrigidas o mais rápido possível. Verifica-se na prática que determinados parâmetros dos sistemas podem variar durante o processo, devido a características específicas ou o desgaste natural de seus componentes. Sabe-se também que, mesmo nos sistemas bem projetados, a ocorrência de trincas em alguns componentes pode provocar perdas econômicas ou conduzir a situações perigosas. Os observadores de estado podem reconstruir os estados não medidos do sistema, desde que os mesmos sejam observáveis, tornando possível, desta forma, estimar as medidas nos pontos de difícil acesso. A técnica dos observadores de estado consiste em desenvolver um modelo para o sistema em análise e comparar a estimativa da saída com a saída medida, a diferença entre os dois sinais presentes resulta em um resíduo que é utilizado para análise. Neste trabalho foi montado um banco de observadores associado a um modelo de trinca de modo a acompanhar o progresso da mesma. Os resultados obtidos através de simulações computacionais em uma placa engastada discretizada pela técnica dos elementos finitos e as análises experimentais realizadas foram bastante satisfatórios, validando a metodologia desenvolvida. / Nowadays a main factor of interest in industries in the development of new techniques for detection and localization of faults is the concern with the security of its systems. There is the need of supervising and monitoring the machines to detect and correct the fault as soon as possible. In practice it is verified that some determined parameters of the systems can vary during the process, due to the specific characteristics or the natural wearing of its components. It is known that even in well-designed systems the occurrence of cracks in some components can induce economic losses or lead to dangerous situations. The state observers methodology can reconstruct the unmeasured states of the system, since they are observable, becoming possible in this way to estimate the measures at points of difficult access. The technique of state observers consists of developing a model for the system under analysis and to compare the estimated with the measured exit, and the difference between these two signals results in a residue that is used for analysis. In this work was set up a bank of observers associated to a model of crack in order to follow its progress. The results obtained through computational simulations in a cantilever plate discretized by using the finite elements technique and the accomplished experimental analysis were sufficiently satisfactory, validating the developed methodology.

Le travail décrit dans cette thèse porte sur une nouvelle méthodologie de caractérisation des circuits sécurisés basée sur une rétro-conception matérielle partielle : d’une part afin d’améliorer l’injection de fautes laser, d’autre part afin de détecter la présence de Chevaux de Troie Matériels (CTMs). Notre approche est dite partielle car elle est basée sur une seule couche matérielle du composant et car elle ne vise pas à recréer une description schématique ou fonctionnelle de l’ensemble du circuit.Une méthodologie invasive de rétro-conception partielle bas coût, rapide et efficace est proposée. Elle permet d’obtenir une image globale du circuit où seule l’implémentation des caissons des transistors est visible. La mise en œuvre de cette méthodologie est appliquée sur différents circuits sécurisés. L’image obtenue selon la méthodologie déclinée précédemment est traitée afin de localiser spatialement les portes sensibles, voire critiques en matière de sécurité. Une fois ces portes sensibles identifiées, nous caractérisons l’effet du laser sur différentes parties de ces cellules de bases et nous montrons qu’il est possible de contrôler à l’aide d’injections de fautes laser la valeur contenue dans ces portes. Cette technique est inédite car elle valide le modèle de fautes sur une porte complexe en technologie 90 nm. Pour finir une méthode de détection de CTMs est proposée avec le traitement de l’image issue de la rétro-conception partielle. Nous mettons en évidence l’ajout de portes non répertoriées avec l’application sur un couple de circuits. La méthode permet donc de détecter, à moindre coût, de manière rapide et efficace la présence de CTMs. / The work described in this thesis covers an integrated circuit characterization methodology based on a partial hardware reverse engineering. On one hand in order to improve integrated circuit security characterization, on the other hand in order to detect the presence of Hardware Trojans. Our approach is said partial as it is only based on a single hardware layer of the component and also because it does not aim to recreate a schematic or functional description of the whole circuit. A low cost, fast and efficient reverse engineering methodology is proposed. The latter enables to get a global image of the circuit where only transistor's active regions are visible. It thus allows localizing every standard cell. The implementation of this methodology is applied over different secure devices. The obtained image according to the methodology declined earlier is processed in order to spatially localize sensible standard cells, nay critical in terms of security. Once these cells identified, we characterize the laser effect over different location of these standard cells and we show the possibility with the help of laser fault injection the value they contain. The technique is novel as it validates the fault model over a complex gate in 90nm technology node.Finally, a Hardware Trojan detection method is proposed using the partial reverse engineering output. We highlight the addition of few non listed cells with the application on a couple of circuits. The method implementation therefore permits to detect, without full reverse-engineering (and so cheaply), quickly and efficiently the presence of Hardware Trojans.

Testing software-intensive systems can be challenging, especially when safety requirements are involved. Property-Based Testing (PBT) is a software testing technique where properties about software are specified and thousands of test cases with a wide range of inputs are automatically generated based on these properties. PBT does not formally prove that the software fulfils its specification, but it is an efficient way to identify deviations from the specification. Safety-critical systems that must be able to deal with faults, without causing damage or injuries, are often tested using Fault Injection (FI) at several abstraction levels. The purpose of FI is to inject faults into a system in order to exercise and evaluate fault handling mechanisms. The aim of this thesis is to investigate how knowledge and techniques from the areas of FI and PBT can be used together to test functional and safety requirements simultaneously. We have developed a FI tool named FaultCheck that enables PBT tools to use common FI-techniques directly on source code. In order to evaluate and demonstrate our approach, we have applied our tool FaultCheck together with the commercially available PBT tool QuickCheck on a simple and on a complex system. The simple system is the AUTOSAR End-to-End (E2E) library and the complex system is a quadcopter simulator that we developed ourselves. The quadcopter simulator is based on a hardware quadcopter platform that we also developed, and the fault models that we inject into the simulator using FaultCheck are derived from the hardware quadcopter platform. We were able to efficiently apply FaultCheck together with QuickCheck on both the E2E library and the quadcopter simulator, which gives us confidence that FI together with PBT can be used to test and evaluate a wide range of simple and complex safety-critical software. / <p>This research has been funded through the PROWESS EU project (Grant agreement no: 317820), the KARYON EU project (Grant agreement no: 288195) and through EISIGS (grants from the Knowledge Foundation).</p> / PROWESS / KARYON

No description available.

Le principal objectif de nos travaux était l’établissement de modèles suffisamment précis pour étudier le comportement des machines électriques en présence d’un défaut de court-circuit entre spires et d’en déduire les signatures pertinentes pour la détection de ce type de défaut. L’autre objectif était de dimensionner des machines électriques à courant de court-circuit d’amplitude limitée pour réduire le risque de propagation du défaut. La première approche de modélisation consiste à effectuer une étude complète en utilisant la méthode d’éléments finis pas à pas dans le temps. Les résultats obtenus par ce modèle "éléments finis" concernant une MSAP et une MAS, saines et aussi en présence de plusieurs défauts "entre spires" de niveaux de sévérité différents, concordent avec ceux obtenus expérimentalement sur deux bancs d’essai. La seconde approche a consisté à mettre au point un modèle "circuits électriques" dont la complexité dépend du type de structure magnétique et du type de bobinage de la machine étudiée. Nous avons proposé deux méthodes de détermination des paramètres : 1- des méthodes numériques (éléments finis) ; 2- l’établissement des nouvelles expressions analytiques. Dans le dernier chapitre, une méthode basée sur la segmentation des aimants sous un pôle qui n’est en fait qu’une démultiplication du nombre de pôles au rotor sans modification du bobinage statorique est proposée est utilisé pour réduire le courant de défaut / The main objective of this research is to establish the sufficiently precise models to study the behavior of electrical machines in the presence of inter-turn short circuit fault and then find the relevant signatures to detect this type of fault. The other objective is to design a limited short-circuit current electrical machines to reduce the risk of fault development. The first modeling approach is a comprehensive study using the time stepping finite element method. The results obtained by this model "finite element" on a MSAP and MAS, healthy and faulty, for different levels of fault severity, are close with those obtained experimentally by two test benches. The second approach is to develop a model circuit electric, whose complexity depends on the type of magnetic structure and the type of machine winding. We have proposed two methods for determining the model parameters: 1 - numerical methods (FEM) which require long time bur very precise; 2 – establish new analytical expressions which is fast but less precise. In the last part, a method based on segmentation of the magnet is presented in order to reduce the short circuit current. The segmented PM motor contains the reduced fault current and can be used in the application which requires high degree of reliability

Der vierte Band der wissenschaftlichen Schriftenreihe Eingebettete Selbstorganisierende Systeme widmet sich der Entwicklung von Fehlermodellen für eingebettete, verteilte Multi – Prozessorsysteme. Diese werden zu einem hierarchischen Netzwerk zur Steuerung von Flugzeugen (Avionik) verbunden und mehr und mehr im Automotive Bereich eingesetzt. Hier gilt es höchste Sicherheitsstandards einzuhalten und maximale Verfügbarkeit zu garantieren. Herr Fischer integriert die Modellierung von möglichen Fehlern in den Entwurfsprozess. Auf Grundlage des π-Kalküls entwickelt Herr Fischer ein formales Fehlermodell, das eine einheitliche Modellierung von Fehlerfällen unterstützt. Dabei werden interessante Bezüge zur Bi-Simulation sowie zu Methoden des Modell Checkings hergestellt. Die theoretischen Ergebnisse werden an einem komplexen Beispiel anschaulich illustriert. So kann der Leser die Mächtigkeit des entwickelten Ansatzes nachvollziehen und wird motiviert, die entwickelte Methodik auf weitere Anwendungsfälle zu übertragen. / The 4th volume of the scientific series Eingebettete, selbstorganisierende Systeme (Embedded Self-Organized Systems) outlines the design of fault models for embedded distributed multi processor systems. These multi processor systems will be connected to a hierarchical network to control airplanes (avionics) and also be used more and more in the automotive area. Here it is essential to meet highest safety standards and to ensure the maximum of availability. Mr Fischer integrates the modelling of potential faults into the design process. Based on the pi-calculus, he develops a formal framework, which supports a standardised modelling of faults. Thereby, interesting connections to the Bi-Simulation as well as to methods of the Model checking are established. The theoretical results are depicted on a complex example. So it is possible for the reader to understand the complexity of this approach and is motivated to use the developed methodology in other applications. I am glad that Mr Fischer publishes his important research in this scientific series.

Der vierte Band der wissenschaftlichen Schriftenreihe Eingebettete Selbstorganisierende Systeme widmet sich der Entwicklung von Fehlermodellen für eingebettete, verteilte Multi – Prozessorsysteme. Diese werden zu einem hierarchischen Netzwerk zur Steuerung von Flugzeugen (Avionik) verbunden und mehr und mehr im Automotive Bereich eingesetzt. Hier gilt es höchste Sicherheitsstandards einzuhalten und maximale Verfügbarkeit zu garantieren. Herr Fischer integriert die Modellierung von möglichen Fehlern in den Entwurfsprozess. Auf Grundlage des π-Kalküls entwickelt Herr Fischer ein formales Fehlermodell, das eine einheitliche Modellierung von Fehlerfällen unterstützt. Dabei werden interessante Bezüge zur Bi-Simulation sowie zu Methoden des Modell Checkings hergestellt. Die theoretischen Ergebnisse werden an einem komplexen Beispiel anschaulich illustriert. So kann der Leser die Mächtigkeit des entwickelten Ansatzes nachvollziehen und wird motiviert, die entwickelte Methodik auf weitere Anwendungsfälle zu übertragen. / The 4th volume of the scientific series Eingebettete, selbstorganisierende Systeme (Embedded Self-Organized Systems) outlines the design of fault models for embedded distributed multi processor systems. These multi processor systems will be connected to a hierarchical network to control airplanes (avionics) and also be used more and more in the automotive area. Here it is essential to meet highest safety standards and to ensure the maximum of availability. Mr Fischer integrates the modelling of potential faults into the design process. Based on the pi-calculus, he develops a formal framework, which supports a standardised modelling of faults. Thereby, interesting connections to the Bi-Simulation as well as to methods of the Model checking are established. The theoretical results are depicted on a complex example. So it is possible for the reader to understand the complexity of this approach and is motivated to use the developed methodology in other applications. I am glad that Mr Fischer publishes his important research in this scientific series.

Η μεταπτυχιακή αυτή εργασία μπορεί να χωριστεί σε δύο λογικά μέρη (Μέρος Α’ και Μέρος Β’). Το πρώτο μέρος αφορά τον έλεγχο ορθής λειτουργίας ψηφιακών κυκλωμάτων χρησιμοποιώντας το μοντέλο των Μεταβατικών (Transient) σφαλμάτων και πιο συγκεκριμένα περιλαμβάνει την μελέτη για το μοντέλο, τρόπο λειτουργίας και την υλοποίηση ενός Εξομοιωτή Μεταβατικών Σφαλμάτων (Transition Faults Simulator). Ο εξομοιωτής σφαλμάτων αποτελεί το πιο σημαντικό μέρος της αλυσίδας εργαλείων που απαιτούνται για τον σχεδιασμό και εφαρμογή τεχνικών ελέγχου ορθής λειτουργίας και η ύπαρξη ενός τέτοιου εργαλείου επιτρέπει την μελέτη νέων τεχνικών ελέγχου κάνοντας χρήση του Μεταβατικού μοντέλου σφαλμάτων. Το δεύτερο μέρος της εργασίας συνοψίζει την μελέτη που πραγματοποιήθηκε για την δημιουργία ενός νέου αλγόριθμου επιλογής διανυσμάτων ελέγχου στην περίπτωση των Test Set Embedding τεχνικών ελέγχου. Ο αλγόριθμος επιτυγχάνει σημαντικές μειώσεις τόσο στον όγκο των απαιτούμενων δεδομένων που είναι απαραίτητο να αποθηκευτούν για την αναπαραγωγή του ελέγχου, σε σχέση με τις κλασικές προσεγγίσεις ελέγχου, όσο και στο μήκος των απαιτούμενων ακολουθιών ελέγχου που εφαρμόζονται στο υπό-έλεγχο κύκλωμα σε σχέση με προγενέστερους Test Set Embedding αλγορίθμους. Στο τέλος του μέρους Β’ προτείνεται μία αρχιτεκτονική για την υλοποίηση του αλγόριθμου σε Built-In Self-Test περιβάλλον ελέγχου ορθής λειτουργίας ακολουθούμενη από την εκτίμηση της απόδοσης αυτής και σύγκριση της με την καλύτερη ως τώρα προτεινόμενη αρχιτεκτονική που υπάρχει στην βιβλιογραφία (Βλέπε Παράρτημα Α). / The thesis consists of two basic parts that apply in the field of VLSI testing of integrated circuits. The first one concludes the work that has been done in the field of VLSI testing using the Transient Fault model and more specifically, analyzes the model and the implementation of a Transition Fault Simulator. The transient fault model moves beyond the scope of the simple stuck-at fault model that is mainly used in the literature, by introducing the concept of time and therefore enables the testing techniques to be more precise and closer to reality. Furthermore, a fault simulator is probably the most important part of the tool chain that is required for the design, implementation and study of vlsi testing techniques and therefore having such a tool available, enables the study of new testing techniques using the transient fault model. The second part of the thesis summaries the study that took place for a new technique that reduces the test sequences of reseeding-based schemes in the case of Test Set Embedding testing techniques. The proposed algorithm features significant reductions in both the volumes of test data that are required to be stored for the precise regeneration of the test sequences, and the length of test vector sequences that are applied on the circuit under test, in comparison to the classical proposed test techniques that are available in the literature. In addition to the algorithm, a low hardware overhead architecture for implementing the algorithm in Built-in Self-Test environment is presented for which the imposed hardware overhead is confined to just one extra bit per seed, plus one, very small, extra counter in the scheme’s control logic. In the end of the second part, the proposed architecture is compared with the best so far proposed architecture available in the literature (see Appendix A)