Concurrent Error Detection Scheme Research Articles

Beware of Insufficient Redundancy

Fault injection attacks pose a serious threat to cryptographic implementations. Countermeasures beyond sensors and shields usually deploy some form of redundancy to detect or even correct errors. A few years ago, a novel design methodology called Impeccable Circuits has been introduced on how to correctly integrate Concurrent Error Detection (CED) schemes, based on Error-Detection Codes (EDCs), into cryptographic hardware circuits. The underlying adversary model limits attackers to inject at most t single-bit faults. By additionally considering the propagation of faults in combinational circuits, the countermeasure guarantees detection of any faulty computation caused by up to t single-bit faults.In this work, we present an experimental analysis of the Impeccable Circuits countermeasure and its underlying assumptions in modern semiconductor technology. More precisely, we have taken hardware implementations of the lightweight block cipher SKINNY equipped with various forms of the EDC-based CED schemes and realized them as cryptographic co-processors on a 40nm ASIC to experimentally evaluate their resistance to Laser Fault Injection (LFI) attacks. In short, our results show that it is fairly simple to overcome the protection offered by the integrated countermeasures when the length of the code n is smaller than twice its rank k (i.e., no full redundancy). This is not caused by any flaw in the underlying design methodology or concept, but merely demonstrates how easily the defined adversary model can be overcome. In our case, a standard black-box scan over the target using a common single-shot LFI setup is sufficient to occasionally inject more single-bit faults than those bounded by the underlying adversary model when n < 2k. The probability of such events proved to be large enough to perform successful key-recovery attacks via Differential Fault Analysis (DFA) in a matter of hours. Thus, we caution against limiting the redundancy in code-based FI countermeasures to less than the number of bits per word, especially in nanometer technologies, and point out that less-complex countermeasures like duplication showed a higher level of resistance in our experiments at a lower cost.

Impeccable Circuits

By injecting faults, active physical attacks pose serious threats to cryptographic hardware where Concurrent Error Detection (CED) schemes are promising countermeasures. They are usually based on an Error-Detecting Code (EDC) which enables detecting certain injected faults depending on the specification of the underlying code. Here, we propose a methodology to enable correct, practical, and robust implementation of code-based CEDs. We show that straightforward hardware implementations of given code-based CEDs can suffer from severe vulnerabilities, not providing the desired protection level. In particular, propagation of faults into combinatorial logic is often ignored in security evaluation of these schemes. First, we formally define this detrimental effect and demonstrate its destructive impact. Second, we introduce an implementation strategy to limit the fault propagation effect. Third, in contrast to many other works where the fault coverage is the main focus, we present a detailed implementation strategy which can guarantee the detection of any fault covered by the underlying EDC. This holds for any time of the computation and any location in the circuit, both in data processing and control unit. In short, we provide practical guidelines how to construct efficient CED schemes with arbitrary EDCs to achieve the desired protection level. We practically evaluate the efficiency of our methodology by case studies covering different symmetric block ciphers and various linear EDCs.

Generic Parity-Based Concurrent Error Detection for Lightweight ARX Ciphers

Cryptographic functions for constrained processing environments can be devised using lightweight cryptography. For use in safety relevant automotive applications where transient faults can occur at runtime the calculation of a cipher text requires verification. We propose an algorithm to generate a group parity based concurrent error detection for generic ciphers based on addition, rotation and XOR (ARX). The generated function is capable of detecting odd hamming weight faults according to the single event error model used in automotive applications. The the generated fault detection scheme is smaller in circuit size than presently existing concurrent error detection schemes and can be executed parallel to the cryptographic function. We provide a proof for the correctness of the generated prediction function and estimate the circuit complexity in terms of size and depth. We evaluate our solution in terms of gate count and throughput on IC synthesis level.

An Implication-based Test Scheme for Both Diagnosis and Concurrent Error Detection Applications

This article describes a diagnosis-aware hybrid concurrent error detection ( DAH-CED ) scheme that can facilitate both off-line and on-line test applications. By using the proposed scheme, not only the probability of detecting errors (on-line) but also the diagnosability of the target circuit (off-line) can be significantly enhanced. The proposed scheme combines the implication-based method with the parity check method. In particular, novel algorithms are developed to identify specific implications for enhancing the diagnosability for the modeled faults proactively. Furthermore, a reduction algorithm is also presented to minimize the number of the employed implications, while no loss on probability of detecting errors and diagnosability is also guaranteed. To the best of our knowledge, this issue is not addressed in the literature. To validate the proposed scheme, not only stuck-at faults but also transition faults are considered to simulate the timing-related errors. The experimental results on nine ITC’99 benchmark circuits show that the diagnosability for stuck-at (transition) faults is enhanced by 6.88% (7.78%) by applying the proposed scheme. As for the probability of detecting errors, 97.73% (97.10%) is achieved for errors caused by stuck-at (transition) faults. Moreover, only 3.11% of implications are needed.

Perfect Concurrent Fault Detection in CMOS Logic Circuits Using Parity Preservative Reversible Gates

Reversible logic has 100% fault observability meaning that a fault in any circuit node propagates to the output stage. In other words, reversible circuits are latent-fault-free. Our motivation is to incorporate this unique feature of reversible logic to design CMOS circuits having perfect or 100% Concurrent Error Detection (CED) capability. For this purpose, we propose a new fault preservative reversible gate library called Even Target - Mixed Polarity Multiple Control Toffoli (ET-MPMCT). By using ET-MPMCT, we ensure that the evenness/oddness of applied 1’s at input, is preserved at all levels of a circuit including output level unless there is a faulty node. A single fault always destroys the parity of input at the output. Our design strategy has two steps for a given function: 1) implement the function with our proposed reversible ET-MPMCT gate library; and 2) apply reversible-to-CMOS gate conversion. For the first step, we propose two approaches. For our first approach in step 1, we first need to have a reversible form of the given function if it is irreversible. Then, synthesize the reversible function using Mixed Polarity Multiple Control Toffoli (MPMCT) gate library by conventional reversible logic synthesis techniques. Finally, the synthesized circuit is converted to ET-MPMCT constructed circuit which is fault preservative. Our second approach, is an ESOP - Exclusive Sum of Products - based synthesis approach modified for our proposed fault preservative ET-MPMCT gate library. It does work with both irreversible and reversible functions. We synthesize our circuits with both approaches in step 1 and choose the circuit with lower number of reversible gates to be fed to step 2 of our design strategy. In second step of our design strategy, we convert our fault preservative reversible circuits into their CMOS counterparts. The performance of our designs is compared with other CED schemes in the literature in terms of area, power consumption, delay and detection rate. Simulations are done with Cadence Genus tool using TSMC 40nm technology. Clearly, results are in favor of our proposed techniques.

Attacks in Reality: the Limits of Concurrent Error Detection Codes Against Laser Fault Injection

As a prominent attack approach against the security modules of integrated circuits, fault injection attacks (FIA) are able to breach thecryptographic primitives by analyzing the intentionally induced computation errors by adversaries. Parity-based Concurrent Error Detection (CED) techniques are often deployed as a countermeasure, owing to their low-overhead. Advanced linear and non-linear randomized encodings can be employed for constructing varying CED schemes. In this paper, we first evaluate the detection capability of linear parity-protected ciphers implemented in commercial FPGA, using laser fault injection (LFI) technique. A single-bit linear parity scheme is shown to be ineffective for error detection, since the LFI can typically flip multiple bits that are close to each other. On the other hand, a linear randomized parity scheme, with multiple bits parity, shows higher detection rates. Further, we study existing (randomized) non-linear encoding-based CED. With practical fault distributions on PRESENT cipher, non-linear randomized codes are extensively tested against fault injection. Although, known to have better theoretical detection bounds, non-linear encodings do not provide much improvements over simple randomized linear codes.

Lightweight Architectures for Reliable and Fault Detection Simon and Speck Cryptographic Algorithms on FPGA

The widespread use of sensitive and constrained applications necessitates lightweight (low-power and low-area) algorithms developed for constrained nano-devices. However, nearly all of such algorithms are optimized for platform-based performance and may not be useful for diverse and flexible applications. The National Security Agency (NSA) has proposed two relatively recent families of lightweight ciphers, that is, Simon and Speck, designed as efficient ciphers on both hardware and software platforms. This article proposes concurrent error detection schemes to provide reliable architectures for these two families of lightweight block ciphers. The research work on analyzing the reliability of these algorithms and providing fault diagnosis approaches has not been undertaken to date to the best of our knowledge. The main aim of the proposed reliable architectures is to provide high error coverage while maintaining acceptable area and power consumption overheads. To achieve this, we propose a variant of recomputing with encoded operands. These low-complexity schemes are suited for low-resource applications such as sensitive, constrained implantable and wearable medical devices. We perform fault simulations for the proposed architectures by developing a fault model framework. The architectures are simulated and analyzed on recent field-programmable grate array (FPGA) platforms, and it is shown that the proposed schemes provide high error coverage. The proposed low-complexity concurrent error detection schemes are a step forward toward more reliable architectures for Simon and Speck algorithms in lightweight, secure applications.

Accurate reliability analysis of concurrent checking circuits employing an efficient analytical method

Transient faults are important concerns in emerging ICs built from deep semiconductors. Concurrent error detection (CED) scheme has been proved to be an efficient technique in such a context. On the other hand, the increase of multiple faults can be foreseeable in future ICs. However, reported efforts applied to quantify the efficiency of CED schemes mostly consider single faults or suppose that implemented checker mechanisms are fault-free. This paper describes an alternative analytical solution for CED circuits analysis under a more realistic hypothesis. In addition to the assumption of the whole fault-prone circuit (including checker mechanisms), different failure rates of logic gate are considered as well. The proposed approach is based on probabilistic transfer matrices and then can deal with multiple faults. The time efficiency of the proposed solution is demonstrated through arithmetic circuits. By applying this solution, classical CED schemes are discussed according to different failure rates of transistor.

Low-Cost Concurrent Error Detection for GCM and CCM

In many applications, encryption alone does not provide enough security. To enhance security, dedicated authenticated encryption (AE) mode are invented. Galios Counter Mode (GCM) and Counter with CBC-MAC mode (CCM) are the AE modes recommended by the National Institute of Standards and Technology. To support high data rates, AE modes are usually implemented in hardware. However, natural faults reduce its reliability and may undermine both its encryption and authentication capability. We present a low-cost concurrent error detection (CED) scheme for 7 AE architectures. The proposed technique explores idle cycles of the AE mode architectures. Experimental results shows that the performance overhead can be lower than 100 % for all architectures depending on the workload. FPGA implementation results show that the hardware overhead in the 0.1–23.3 % range and the power overhead is in the 0.2–23.2 % range. ASIC implementation results show that the hardware overhead in the 0.1–22.8 % range and the power overhead is in the 0.3–12.6 % range. The underlying block cipher and hash module need not have CED built in. Thus, it allows system designers to integrate block cipher and hash function intellectual property from different vendors.

Efficient and Concurrent Reliable Realization of the Secure Cryptographic SHA-3 Algorithm

The secure hash algorithm (SHA)-3 has been selected in 2012 and will be used to provide security to any application which requires hashing, pseudo-random number generation, and integrity checking. This algorithm has been selected based on various benchmarks such as security, performance, and complexity. In this paper, in order to provide reliable architectures for this algorithm, an efficient concurrent error detection scheme for the selected SHA-3 algorithm, i.e., Keccak, is proposed. To the best of our knowledge, effective countermeasures for potential reliability issues in the hardware implementations of this algorithm have not been presented to date. In proposing the error detection approach, our aim is to have acceptable complexity and performance overheads while maintaining high error coverage. In this regard, we present a low-complexity recomputing with rotated operands-based scheme which is a step-forward toward reducing the hardware overhead of the proposed error detection approach. Moreover, we perform injection-based fault simulations and show that the error coverage of close to 100% is derived. Furthermore, we have designed the proposed scheme and through ASIC analysis, it is shown that acceptable complexity and performance overheads are reached. By utilizing the proposed high-performance concurrent error detection scheme, more reliable and robust hardware implementations for the newly-standardized SHA-3 are realized.

Reliable Concurrent Error Detection Architectures for Extended Euclidean-Based Division Over <inline-formula> <tex-math notation="TeX">${\rm GF}(2^{m})$ </tex-math></inline-formula>

The extended Euclidean algorithm (EEA) is an important scheme for performing the division operation in finite fields. Many sensitive and security-constrained applications such as those using the elliptic curve cryptography for establishing key agreement schemes, augmented encryption approaches, and digital signature algorithms utilize this operation in their structures. Although much study is performed to realize the EEA in hardware efficiently, research on its reliable implementations needs to be done to achieve fault-immune reliable structures. In this regard, this paper presents a new concurrent error detection (CED) scheme to provide reliability for the aforementioned sensitive and constrained applications. Our proposed CED architecture is a step forward toward more reliable architectures for the EEA algorithm architectures. Through simulations and based on the number of parity bits used, the error detection capability of our CED architecture is derived to be 100% for single-bit errors and close to 99% for the experimented multiple-bit errors. In addition, we present the performance degradations of the proposed approach, leading to low-cost and reliable EEA architectures. The proposed reliable architectures are also suitable for constrained and fault-sensitive embedded applications utilizing the EEA hardware implementations.

Concurrent Error Detection of Binary and Nonbinary OLS Parallel Decoders

This paper presents a concurrent error detection (CED) scheme for orthogonal Latin square (OLS) parallel decoders. Different from a CED scheme found in the technical literature that protects only the syndrome generator, the proposed CED scheme protects the whole OLS decoder for single stuck-at faults. This paper presents the detailed design and analysis of the proposed CED scheme and shows that it is strongly fault secured for single stuck-at faults. Extensive simulation results are also provided; different figures of merit such as area, power dissipation, gate depth, and coverage are assessed. It is shown that the proposed decoder designs for ( n, k) t-bit error correcting OLS codes (k = 16 ...256; t = 2 ...5) have reasonable overhead; for example, the average area overhead of the proposed CED is 35.5 (23.6) % compared with an OLS decoder with no CED (i.e., the previously reported CED scheme). However, the most significant advantage of the proposed scheme is that it achieves 100% fault coverage for the whole CED circuit, thus providing a very efficient and fully fault-tolerant implementation. The proposed CED is applicable to both binary and nonbinary OLS codes; the CED for a nonbinary OLS decoder achieves comparable or better results than a binary OLS decoder. Moreover, simulation shows that the proposed CED scheme is better than double modular redundancy.

ERROR DETECTION SCHEMES FOR FINITE FIELD MULTIPLIERS

Finite field multipliers are widely used in the fie ld of cryptography for the purpose of scalar multip lication. The outputs of the finite field multipliers may con sist of errors due to certain natural radiations wh ich further leads to the failure of the cryptosystems. Here two Concurrent Error Detection (CED) schemes namely time redundancy and modular inversion based error detection schemes for finite field multiplier s are discussed. The CED techniques have been implemented for bit serial, digit serial and bit parallel Montgomery multipliers. The Simulation results are obtained using Modelsim10.0b, area and power analysis has been performed using Xilinx ISE 9.1i. The proposed modular inversion based CED scheme is found to be area and power efficient compared to ex isting time redundancy based CED scheme.

A SYSTEMATIC FLOW FOR DEVELOPING TOTALLY SELF-CHECKING ARCHITECTURES FOR SHA-1 AND SHA-2 CRYPTOGRAPHIC HASH FAMILIES

Hash functions are among the crucial modules of modern hardware cryptographic systems. These systems frequently operate in harsh and noisy environments where permanent and/or transient faults are often causing erroneous authentication results and collapsing of the whole authentication procedure. Hence, their on-time detection is an urgent feature. In this paper, a systematic development flow towards totally self-checking (TSC) architectures of the most widely-used cryptographic hash families, SHA-1 and SHA-2, is proposed. Novel methods and techniques are introduced to determine the appropriate concurrent error detection scheme at high level avoiding gate-level implementations and comparisons. The resulted TSC architectures achieve 100% fault detection of odd erroneous bits, while, depending on the designer's choice, even number of erroneous bits can also be detected. Two representative functions of the above families, namely the SHA-1 and SHA-256, are used as case studies. For each of them, two TSC architectures (one un-optimized and one optimized for throughput) were developed via the proposed flow and implemented in TSMC 0.18 μm CMOS technology. The produced architectures are more efficient in terms of throughput/area than the corresponding duplicated-with-checking ones by 19.5% and 23.8% regarding the un-optimized TSC SHA-1 and SHA-256 and by 20.2% and 24.6% regarding the optimized ones.

Reconfigurable Concurrent Error Detection Adaptive to Dynamicity of Power Constraints

Concurrent Error Detection (CED) methods provide some level of error detection capability at the cost of some area and power overhead. Incorporating CED schemes into Integrated Circuits (ICs) is becoming increasingly more important, as the continuous technology scaling leads to an ever-higher transient error-related failure rate. For many applications, the error detection capability must be reconfigured dynamically, in order to adapt to the available power budget, criticality of the processed data, etc. In this work, we propose a reconfigurable duplication-based CED infrastructure for ICs. While duplication provides high CED coverage, its power budget requirement of having two circuits operate all the time limits its application. The key idea of reconfiguration is to enable/disable the operation of the duplicate circuit according to a set of control conditions. When CED is disabled, the inputs to the duplicate circuit retain their previous values (i.e., reduction in power dissipation via elimination of switching activity), yet errors are not detected (i.e., reduction in CED coverage). Experimental results using random and judicious selection of control conditions indicate that power dissipation is commensurate with CED coverage, supporting the use of LFSR structures to easily generate and adjust conditions dynamically to adapt to the power constraints of the system during its operation. Moreover, online testing using nonidentical input vectors can also be incorporated, improving the tradeoff between power dissipation and CED coverage.

Homomorphic Property-Based Concurrent Error Detection of RSA: A Countermeasure to Fault Attack

Fault-based attacks, which recover secret keys by deliberately introducing fault(s) in cipher implementations and analyzing the faulty outputs, have been proved to be extremely powerful. In this paper, we propose a novel Concurrent Error Detection (CED) scheme to counter fault-based attack against RSA by exploiting its multiplicative homomorphic property. Specifically, the proposed CED scheme verifies if Π <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">i=1</sub> <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">k</sup> E(m <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">i</sub> ) ≡ EΠ <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">i=1</sub> <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">k</sup> m <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">i</sub> (mod n) (mod n) where E could be either RSA encryption, or decryption, or signature, or verification process. Upon a mismatch, all the ciphertexts will be suppressed. The time overhead is 1/k and k can be used to trade-off the time overhead with memory overhead and output latency. Recognizing that an RSA device could be subject to a combination of several side-channel attacks, the proposed scheme enables an easy divide-and-concur solution-any fine-tuned architecture, for example, a power-attack-resistant architecture, can be equipped with fault-attack resistance easily without disturbing its original resistance. This advantage distinguishes the proposed scheme over the existing countermeasures.

Workload-Cognizant Concurrent Error Detection in the Scheduler of a Modern Microprocessor

We present a Concurrent Error Detection (CED) scheme for the Scheduler of a modern microprocessor. The proposed CED scheme is based on monitoring a set of invariances imposed through added hardware, violation of which signifies the occurrence of an error. The novelty of our solution stems from the workload-cognizant way in which these invariances are selected so that they leverage the application-level error masking inherent in program execution. Specifically, in order to ensure cost-effectiveness of the hardware employed to construct these invariances, we make use of information regarding the type and frequency of errors affecting the typical workload of the microprocessor. Thereby, we identify the most susceptible aspects of instruction execution and we accordingly distribute CED resources to protect them. Our approach is demonstrated on the Scheduler of an Alpha-like superscalar microprocessor with dynamic scheduling, hybrid branch prediction and out-of-order execution capabilities. Using an extensive fault-simulation infrastructure that we developed around this microprocessor, we profile the impact of Scheduler faults across a variety of different SPEC2000 benchmarks. Based on the results, we construct a CED scheme which monitors the time and location of instruction execution, the executed operation, the utilized resources, as well as the executed and retired sequence of instructions. At a hardware cost of only 32 percent of the Scheduler, the corresponding CED scheme detects over 85 percent of its faults that affect the architectural state of the microprocessor. Furthermore, over 99.5 percent of these faults are detected before they corrupt the architectural state, while the average detection latency for the remaining faults is in the order of a few clock cycles, implying that efficient recovery methods can be developed.

Relevant metrics for evaluation of concurrent error detection schemes

Concurrent error detection (CED) schemes are becoming essential features in the design process as IC technologies progress into the nanoscale era. Soft error rate reduction has emerged as an important challenge and several works are dedicated to quantify the CED effective enhancement in systems reliability. However, none of them make a comprehensive description of the output events that can occur in such schemes. In this paper we propose a methodology to evaluate circuits with CED, including the time penalty as a relevant metric even in hardware redundancy techniques. Our experiments have shown that systems can reduce their throughput by half in multiple fault environments making the choice of the CED scheme strongly dependent on this analysis.

Concurrent error detection for finite state machines implemented with embedded memory blocks of SRAM-based FPGAs

We propose a cost-efficient concurrent error detection (CED) scheme for finite state machines (FSMs) designed for implementation with embedded memory blocks (EMBs) available in today’s SRAM-based FPGAs. The proposed scheme is proven to detect each permanent or transient fault associated with a single input or output of any component of the circuit that results in its incorrect state or output. The experimental results obtained using our proprietary FSM synthesis tool show that despite the heterogeneous structure of the proposed CED scheme, the overhead is very low. For the examined benchmark circuits, the circuitry overhead in terms of extra EMBs is in the range of 6.3–56.3%, with an average value of 27.2%, whereas the combined overhead (EMBs and logic cells) calculated under pessimistic assumptions is in the range of 20.7–63.8%, with an average value of 32.2%. This compares favorably with the earlier proposed solutions applicable to conventional FSM designs based on gates and flip–flops for which an overhead exceeding 100% is quite typical.

Concurrent Error Detection in Reed–Solomon Encoders and Decoders

Reed-Solomon (RS) codes are widely used to identify and correct errors in transmission and storage systems. When RS codes are used for high reliable systems, the designer should also take into account the occurrence of faults in the encoder and decoder subsystems. In this paper, self-checking RS encoder and decoder architectures are presented. The RS encoder architecture exploits some properties of the arithmetic operations in GF(2 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">m</sup> ). These properties are related to the parity of the binary representation of the elements of the Galois field. In the RS decoder, the implicit redundancy of the received codeword, under suitable assumptions explained in this paper, allows implementing concurrent error detection schemes useful for a wide range of different decoding algorithms with no intervention on the decoder architecture. Moreover, performances in terms of area and delay overhead for the proposed circuits are presented.