<p>Designing an application specific integrated circuit (ASIC) must be starting with careful preparations, otherwise the chip will not be as good as possible. The theoretical studies must cover everything from the chip circuits to the application structure. In mobile applications there is extremely important that the current consumption becomes minimized because the battery power is limited. The power reductions studies must include the most power costing circuits on the chip. When the whole circuit or segments of the circuit is not in use, they must switch fast and simple into another mode that consume nearly none power. This mode is called sleep-mode. If the sleep-mode has very low leakage currents, the lifetime of the application will dramatically increase. </p><p>This report studies the most power costing circuits in smartcard application ASIC. The chip should be used to control a LCD display on the smartcard. The circuits that have been investigated are level shifters, charge pumps and LCD drivers, also sleep-mode configuration possibilities have been investigated. Other small preparing work is also included in the thesis.</p>

Designing an application specific integrated circuit (ASIC) must be starting with careful preparations, otherwise the chip will not be as good as possible. The theoretical studies must cover everything from the chip circuits to the application structure. In mobile applications there is extremely important that the current consumption becomes minimized because the battery power is limited. The power reductions studies must include the most power costing circuits on the chip. When the whole circuit or segments of the circuit is not in use, they must switch fast and simple into another mode that consume nearly none power. This mode is called sleep-mode. If the sleep-mode has very low leakage currents, the lifetime of the application will dramatically increase. This report studies the most power costing circuits in smartcard application ASIC. The chip should be used to control a LCD display on the smartcard. The circuits that have been investigated are level shifters, charge pumps and LCD drivers, also sleep-mode configuration possibilities have been investigated. Other small preparing work is also included in the thesis.

Les travaux présentés dans cette thèse ont pour objectif de faciliter les évaluations sécuritaires des logiciels embarqués dans les cartes à puce. En premier lieu, nous avons mis au point un environnement logiciel dédié à l'analyse de la résistance d'implémentations d'algorithmes cryptographiques face à des attaques par analyse de la consommation de courant. Cet environnement doit être vu comme un outil pour rechercher des fuites d'information dans une implémentation en vue d'évaluer la faisabilité d'une attaque sur le produit réel. En second lieu, nous nous sommes intéressé à l'analyse de programmes écrits en langage d'assemblage AVR dans le but de vérifier s'ils sont vulnérables aux \textsl{timing attacks}. Nous avons donc développé un outil qui consiste à décrire des chemins du flot de contrôle d'un programme grâce à des expressions régulières qui seront par la suite interprétées par notre outil afin de donner leur temps exact d'exécution (en terme de cycles d'horloge). Enfin, nous avons étudié comment faciliter la compréhension de programmes écrits en langage C dans le but de vérifier si des politiques de sécurité sont correctement implémentées. D'une part, nous fournissons des assistants de navigation qui au travers d'informations concernant les variables et procédures rencontrées, facilitent la compréhension du programme. D'autre part, nous avons au point une manière de vérifier les politiques de sécurité sans modélisation préalable (e.g. avec un automate à états finis) au moyen de requêtes exprimées dans la logique CTL. / The work presented in this thesis aims at easing the evaluation process of smartcards embedded software. On one hand, we set up a software environment dedicated to analyze the implementation resistance of cryptographic to power analysis attacks. This environment must be seen as a tool that facilitates a real attack by giving a way to find information leakages in an implementation. On the other hand, we focused on analyzing program written in AVR assembly language in order to check whether they are vulnerable to timing attacks. To achieve this goal we have developed a tool that makes possible the description of a path in the control flow of the program thanks to regular expressions. Those regular expressions will be interpreted by our tool in order to give the exact execution timing (expressed in clock cycles). Finally, we studied how to ease the global comprehension of a program written in C language in order to check whether security policies are well implemented. First, we provide graphical navigation assisants that helps to understand the progam being analyzed by giving information on variables and procedures. Then, we provide a way to check the security policies through the use of requests expressed with the CTL logic. This approach does not need prior modelisation of the program.

Esta tese apresenta três novos ataques a equipamentos de pagamento eletrônico que possuem teclado mecânico, conhecidos como \"PIN pads\". Mostramos de três formas distintas como tais equipamentos possuem vulnerabilidades de segurança na camada física que permitem o vazamento do PIN (Personal Identification Number) quando o mesmo é digitado. Demonstramos experimentalmente que é possível inferir com elevada taxa de acerto (100% em um dos ataques) a senha digitada, de forma não-invasiva. Os ataques desenvolvidos são baseados na introdução de sensores nos próprios equipamentos ou em seu ambiente de operação: acelerômetros para análise de vibração, microfones para análise acústica e células de carga para medição de forças do pressionamento. Devido à massificação no uso de sensores por dispositivos de consumo, o roubo de informação por meios não convencionais é atividade crescente. Os resultados dos ataques de baixo custo realizados expõem sérias deficiências no processo de certificação de segurança de tais equipamentos. / This thesis presents three new attacks on electronic payment equipment having mechanical keypads, known as \"PIN pads\". We show in three different ways how they have security vulnerabilities at the physical layer allowing the leak of the PIN (Personal Identification Number) when it is entered. We experimentally demonstrated that it is possible to infer with high success rate (100% in one of the attacks) the password entered on the device, in a non-invasive way. The attacks are based on the placement of sensors inside the equipment itself or in its operating environment: accelerometers for doing vibration analysis, microphones for acoustic analysis and load cells for measuring the pressing force. Due to massive deployment of sensors in consumer devices, information theft by unconventional means is increasing. The results of the low-cost attacks here developed expose serious shortcomings in the process of security certification of such equipment.

Esta tese apresenta três novos ataques a equipamentos de pagamento eletrônico que possuem teclado mecânico, conhecidos como \"PIN pads\". Mostramos de três formas distintas como tais equipamentos possuem vulnerabilidades de segurança na camada física que permitem o vazamento do PIN (Personal Identification Number) quando o mesmo é digitado. Demonstramos experimentalmente que é possível inferir com elevada taxa de acerto (100% em um dos ataques) a senha digitada, de forma não-invasiva. Os ataques desenvolvidos são baseados na introdução de sensores nos próprios equipamentos ou em seu ambiente de operação: acelerômetros para análise de vibração, microfones para análise acústica e células de carga para medição de forças do pressionamento. Devido à massificação no uso de sensores por dispositivos de consumo, o roubo de informação por meios não convencionais é atividade crescente. Os resultados dos ataques de baixo custo realizados expõem sérias deficiências no processo de certificação de segurança de tais equipamentos. / This thesis presents three new attacks on electronic payment equipment having mechanical keypads, known as \"PIN pads\". We show in three different ways how they have security vulnerabilities at the physical layer allowing the leak of the PIN (Personal Identification Number) when it is entered. We experimentally demonstrated that it is possible to infer with high success rate (100% in one of the attacks) the password entered on the device, in a non-invasive way. The attacks are based on the placement of sensors inside the equipment itself or in its operating environment: accelerometers for doing vibration analysis, microphones for acoustic analysis and load cells for measuring the pressing force. Due to massive deployment of sensors in consumer devices, information theft by unconventional means is increasing. The results of the low-cost attacks here developed expose serious shortcomings in the process of security certification of such equipment.

Dans le domaine des transactions et du paiement électronique avec une carte à puce, le standard de communication en champ proche « Near Field Communication » (NFC) s’est imposé comme la technologie des transactions sans contact mobiles sécurisées pour le paiement, le contrôle d’accès, ou l’authentification. Les services sans contact mobiles sécurisés sont basés sur le mode émulation de carte du standard NFC qui implique une composante matérielle à accès restreint de type carte à puce appelée « Secure Element » (SE) dans laquelle sont stockées les données confidentielles et les fonctions sensibles. Malgré les efforts de standardisation de l'écosystème, les modèles proposés pour la mise en œuvre du SE sont complexes et souffrent du manque de généricité, à la fois pour offrir des mécanismes d’abstraction, pour le développement d’applications de haut niveau, et pour la mise en œuvre et la vérification des contraintes de sécurité des applications.L’objectif de la thèse est de concevoir et réaliser un environnement logiciel basé sur un modèle générique compatible avec les standards établis et peu sensible aux évolutions technologiques. Cet environnement devrait permettre à des non-experts de développer des applications multiplateformes, multimodes, multi-facteurs de forme, qui s’interfacent avec le SE dans un smartphone NFC. / In the field of electronic transactions and payment with a smart card, the Near Field Communication (NFC) standard has stood out against other candidate technologies for secure mobile contactless transactions for payment, access control, or authentication. Secure mobile contactless services are based on the card emulation mode of the NFC standard which involves a smart card type component with restricted access called "Secure Element" (SE) in which sensitive data and sensitive functions are securely stored and run. Despite considerable standardization efforts around the SE ecosystem, the proposed models for the implementation of SE are complex and suffer from the lack of genericity, both to offer abstraction mechanisms, for the development of high-level applications, and for the implementation and verification of applications security constraints.The objective of the thesis is to design and realize a software environment based on a generic model that complies with established standards and which is not very sensitive to technological evolutions. This environment should enable non-experts to develop multi-platform, multi-mode, multi-factor SE-based applications running into the NFC smartphone.