Faulty Signatures Research Articles

Loop Aborts Strike Back: Defeating Fault Countermeasures in Lattice Signatures with ILP

At SAC 2016, Espitau et al. presented a loop-abort fault attack against lattice-based signature schemes following the Fiat–Shamir with aborts paradigm. Their attack recovered the signing key by injecting faults in the sampling of the commitment vector (also called masking vector) y, leaving its coefficients at their initial zero value. As possible countermeasures, they proposed to carry out the sampling of the coefficients of y in shuffled order, or to ensure that the masking polynomials in y are not of low degree. In this paper, we show that both of these countermeasures are insufficient. We demonstrate a new loop-abort fault injection attack against Fiat–Shamir with aborts lattice-based signatures that can recover the secret key from faulty signatures even when the proposed countermeasures are implemented. The key idea of our attack is that faulted signatures give rise to a noisy linear system of equations, which can be solved using integer linear programming. We present an integer linear program that recovers the secret key efficiently in practice, and validate the efficacy of our attack by conducting a practical end-to-end attack against a shuffled version of the Dilithium reference implementation, mounted on an ARM Cortex M4. We achieve a full (equivalent) key recovery in under 3 minutes total execution time (including signature generation), using only 5 faulted signatures. In addition, we conduct extensive theoretical simulations of the attack against Dilithium. We find that our method can achieve key recovery in under 5 minutes given a (sufficiently large) set of signatures where just one of the coefficients of y is zeroed out (or left at its initial value of zero). Furthermore, we find that our attack works against all security levels of Dilithium. Our attack shows that protecting Fiat–Shamir with aborts lattice-based signatures against fault injection attacks cannot be achieved using the simple countermeasures proposed by Espitau et al. and likely requires significantly more expensive countermeasures.

On Protecting SPHINCS+ Against Fault Attacks

SPHINCS+ is a hash-based digital signature scheme that was selected by NIST in their post-quantum cryptography standardization process. The establishment of a universal forgery on the seminal scheme SPHINCS was shown to be feasible in practice by injecting a fault when the signing device constructs any non-top subtree. Ever since the attack has been made public, little effort was spent to protect the SPHINCS family against attacks by faults. This paper works in this direction in the context of SPHINCS+ and analyzes the current algorithms that aim to prevent fault-based forgeries.First, the paper adapts the original attack to SPHINCS+ reinforced with randomized signing and extends the applicability of the attack to any combination of faulty and valid signatures. Considering the adaptation, the paper then presents a thorough analysis of the attack. In particular, the analysis shows that, with high probability, the security guarantees of SPHINCS+ significantly drop when a single random bit flip occurs anywhere in the signing procedure and that the resulting faulty signature cannot be detected with the verification procedure. The paper shows both in theory and experimentally that the countermeasures based on caching the intermediate W-OTS+s offer a marginally greater protection against unintentional faults, and that such countermeasures are circumvented with a tolerable number of queries in an active attack. Based on these results, the paper recommends real-world deployments of SPHINCS+ to implement redundancy checks.

Delta-T-based operational signatures for operation pattern and fault diagnosis of building energy systems

Energy consumption patterns are key information for efficiently operating energy systems in buildings or primary energy systems in cities. Nevertheless, operation pattern analysis (e.g., signature analysis), presenting the correlations between system variables, is needed to diagnose inefficient operation or system faults because conventional energy usage patterns have limited insight into the operation patterns inside building energy systems. Thus, a novel operation pattern analysis method is proposed for building energy systems using the clustering-based operational signatures. The novelty of this method is that it is based on delta-T signatures in building energy systems. Because delta-T can be a major representative of operational states, delta-T signature-based clustering can determine both normal and faulty operation. Moreover, delta-T (e.g., water temperature differences between supply and return paths) can be easily measured in a basic sensor deployment in a building automation system. The delta-T signatures can be converted into operational and faulty signatures. These features enable the operation pattern analysis to be applied to building energy systems widely without the need for luxurious sensing systems or building energy management systems. In this study, the proposed method was applied to an operational chilled water cooling system for real multiunit residential buildings. The application shows how the delta-T signature-based clustering method can diagnose operation patterns and various faults. In the target buildings, inefficient operation (accounting for 30.8%) was found in the normal delta-T area, and sensor errors (random, bias, and drift) and abnormal device sequences were captured in the negative or extreme delta-T areas. These patterns and faults could be matched to daily cooling energy usage patterns, thus providing a deeper knowledge of operation.

A Novel Fault Detection and Identification Framework for Rotating Machinery Using Residual Current Spectrum.

A novel framework of model-based fault detection and identification (MFDI) for induction motor (IM)-driven rotating machinery (RM) is proposed in this study. A data-driven subspace identification (SID) algorithm is employed to obtain the IM state-space model from the voltage and current signals in a quasi-steady-state condition. This study aims to improve the frequency–domain fault detection and identification (FDI) by replacing the current signal with a residual signal where a thresholding method is applied to the residual signal. Through the residual spectrum and threshold comparison, a binary decision is made to find fault signatures in the spectrum. The statistical Q-function is used to generate the fault frequency band to distinguish between the fault signature and the noise signature. The experiment in this study is performed on a wastewater pump in an existing industrial facility to verify the proposed FDI. Two faulty conditions with mathematically known and mathematically unknown faulty signatures are experimented with and diagnosed. The study results present that the residual spectrum demonstrated to be more sensitive to fault signatures compare to the current spectrum. The proposed FDI has successfully shown to identify the fault signatures even for the mathematically unknown faulty signatures.

JackHammer: Efficient Rowhammer on Heterogeneous FPGA-CPU Platforms

After years of development, FPGAs are finally making an appearance on multi-tenant cloud servers. Heterogeneous FPGA-CPU microarchitectures require reassessment of common assumptions about isolation and security boundaries, as they introduce new attack vectors and vulnerabilities. In this work, we analyze the memory and cache subsystem and study Rowhammer and cache attacks enabled by two proposed heterogeneous FPGA-CPU platforms from Intel: the Arria 10 GX with an integrated FPGA-CPU platform, and the Arria 10 GX PAC expansion card which connects the FPGA to the CPU via the PCIe interface. We demonstrate JackHammer, a novel, efficient, and stealthy Rowhammer from the FPGA to the host’s main memory. Our results indicate that a malicious FPGA can perform twice as fast as a typical Rowhammer from the CPU on the same system and causes around four times as many bit flips as the CPU attack. We demonstrate the efficacy of JackHammer from the FPGA through a realistic fault attack on the WolfSSL RSA signing implementation that reliably causes a fault after an average of fifty-eight RSA signatures, 25% faster than a CPU Rowhammer. In some scenarios our JackHammer attack produces faulty signatures more than three times more often and almost three times faster than a conventional CPU Rowhammer. Finally, we systematically analyze new cache attacks in these environments following demonstration of a cache covert channel across FPGA and CPU.

An Energy Graph-Based Approach to Fault Diagnosis of a Transcritical CO2 Heat Pump

The objective of this paper is to describe an energy-based approach to visualize, identify, and monitor faults that may occur in a water-to-water transcritical CO 2 heat pump system. A representation using energy attributes allows the abstraction of all physical phenomena present during operation into a compact and easily interpretable form. The use of a linear graph representation, with heat pump components represented as nodes and energy interactions as links, is investigated. Node signature matrices are used to present the energy information in a compact mathematical form. The resulting node signature matrix is referred to as an attributed graph and is populated in such a way as to retain the structural information, i.e., where the attribute points to in the physical system. To generate the energy and exergy information for the compilation of the attributed graphs, a descriptive thermal–fluid model of the heat pump system is developed. The thermal–fluid model is based on the specifications of and validated to the actual behavioral characteristics of a physical transcritical CO 2 heat pump test facility. As a first step to graph-matching, cost matrices are generated to represent a characteristic residual between a normal system node signature matrix and a faulty system node signature matrix. The variation in the eigenvalues and eigenvectors of the characteristic cost matrices from normal conditions to a fault condition was used for fault characterization. Three faults, namely refrigerant leakage, compressor failure and gas cooler fouling, were considered. The paper only aims to introduce an approach, with the scope limited to illustration at one operating point and considers only three relatively large faults. The results of the proposed method show promise and warrant further work to evaluate its sensitivity and robustness for small faults.

Detection and diagnosis of bottle capping failures based on motor current signature analysis

Abstract Bottle capping is an important manufacturing process in many production systems. Bottle capping defects, if left unattended, will cause leakage issues during packaging and transportation. To develop a bottle capping defect detection and diagnosis system with lower cost, this paper proposes a data-driven methodology. Our approach is based on the motor current signal from the automatic capping machine, and four different capping defects, such as loose cap, cocked cap, and no cap, are considered in the experiments. Based on the current signal collected from the bottle capping machine, the signal envelope is extracted and smoothed first, and the faulty signatures are discovered subsequently. By designing and selecting appropriate features to describe the discovered fault signature, bottle capping defects can be effectively detected and isolated with the help of machine learning models. The results in the case study demonstrate that all the bottle capping defects considered in this investigation can be effectively detected and isolated.

On Practical Aspects of Using RNNs for Fault Detection in Sparsely-labeled Multi-sensor Time Series

In this work, we attempt to address two practical limitations when using Recurrent Neural Networks (RNNs) as classifiers for fault detection using multi-sensor time series data: Firstly, there is a need to understand the classification decisions of RNNs. It is difficult for engineers to diagnose the faults when multiple sensors are being monitored at once. The faults detected by RNNs can be better understood if the sensors carrying the faulty signature are known. To achieve this, we propose a sensor relevance scoring (SRS) approach that scores each sensor based on its contribution to the classification decision by leveraging the hidden layer activations of RNNs. Secondly, lack of labeled training data due to infrequent faults (or otherwise) makes it difficult to train RNNs in a supervised manner. We pre-train an RNN on large unlabeled data via an autoencoder in an unsupervised manner, and then finetune the RNN for the fault detection task using small amount of labeled training data. Through experiments on a public gasoil heating loop dataset and a proprietary pump dataset, we demonstrate the efficacy of the proposed solutions, and show that i) SRS can help point to the sensors relevant for a fault, ii) large unlabeled data can be used to pre-train an RNNbased fault detector in an unsupervised manner in sparselylabeled scenarios, and iii) a purely unsupervised approach for fault detection (e.g. based on RNN-autoencoders) may not suffice when the number of sensors being monitored is large while the signature for fault is present in only a small subset of sensors.

New Bleichenbacher Records: Fault Attacks on qDSA Signatures

In this paper, we optimize Bleichenbacher’s statistical attack technique against (EC)DSA and other Schnorr-like signature schemes with biased or partially exposed nonces. Previous approaches to Bleichenbacher’s attack suffered from very large memory consumption during the so-called “range reduction” phase. Using a carefully analyzed and highly parallelizable approach to this range reduction based on the Schroeppel–Shamir algorithm for knapsacks, we manage to overcome the memory barrier of previous work while maintaining a practical level of efficiency in terms of time complexity.As a separate contribution, we present new fault attacks against the qDSA signature scheme of Renes and Smith (ASIACRYPT 2017) when instantiated over the Curve25519 Montgomery curve, and we validate some of them on the AVR microcontroller implementation of qDSA using actual fault experiments on the ChipWhisperer-Lite evaluation board. These fault attacks enable an adversary to generate signatures with 2 or 3 bits of the nonces known.Combining our two contributions, we are able to achieve a full secret key recovery on qDSA by applying our version of Bleichenbacher’s attack to these faulty signatures. Using a hybrid parallelization model relying on both shared and distributed memory, we achieve a very efficient implementation of our highly scalable range reduction algorithm. This allows us to complete Bleichenbacher’s attack in the 252-bit prime order subgroup of Curve25519 within a reasonable time frame and using relatively modest computational resources both for 3-bit nonce exposure and for the much harder case of 2-bit nonce exposure. Both of these computations, and particularly the latter, set new records in the implementation of Bleichenbacher’s attack.

Extracting repetitive transients for rotating machinery diagnosis using multiscale clustered grey infogram

Local faults of rotating machinery usually result in repetitive transients whose impulsiveness or cyclostationarity can be employed as faulty signatures. However, to simultaneously accommodate the impulsiveness and the cyclostationarity is a challenging task for rotating machinery diagnostics. Inspired by recently-reported infogram that is sensitive to either the impulsiveness or the cyclostationarity using spectral negentropy defined in time domain or frequency domain, a multiscale clustering grey infogram (MCGI) is proposed by combining both negentropies in a grey fashion using multiscale clustering. Fourier spectrum of the vibration signal is decomposed into multiple scales with different initial resolutions. In each scale, fine segments are grouped using hierarchical clustering. Meanwhile, both time-domain and frequency-domain spectral negentropies are taken into account to guide the clustering through grey evaluation of both negentropies. Numerical simulations and experimental tests are carried out for validating the proposed MCGI. For comparison, peer methods are applied to challenge different noises and interferences. The results show that, thanks to the multiscale clustering of the spectrum and the grey evaluation of both negentropies, the present MCGI is robust in extracting the repetitive transients for the rotating machinery diagnosis.

Unknown Output Values of Faulty Circuits and Output Response Compaction

When using output response compaction it is necessary to address the fact that circuits may produce unknown output values. Methods to address this issue ensure that the output response compactor would produce a unique fault-free signature that can be used for fault detection. This paper considers the unknown output values that are produced by faulty circuits. If a faulty circuit produces an unknown value when the output value of the fault-free circuit is known, the unknown faulty output value may affect the computation of a signature. The faulty signature may not be unique, and it may not always be different from a fault-free signature. The ability to verify that the fault will be detected based on its signature is thus lost. Without limiting the discussion to a particular output response compactor, the paper studies the prevalence of such faults in benchmark circuits, the prevalence of unknown faulty output values for which the corresponding fault-free values are known, and the effects of addressing this issue.

Characteristic Performance Analysis of Squirrel Cage Induction Motor With Broken Bars

This paper presents the results of an investigation of the effects of broken squirrel-cage bars. In the investigation, a comprehensive time-stepping coupled finite element approach was fully used to compute stator current waveforms, torque, magnetic flux density waveform, the rotor bar currents, and end-ring currents for three cases: no broken bars, one broken bar, and two adjacent broken bars. The iron core loss distributions in the stator are computed, and the harmonic component of air gap flux density is analyzed. This paper also gives the computed rotor parameters and the vector diagram of the rotor current in cages with and without broken bars. From these data, the faulty signatures are extracted. Experimental results derived from a two-pole 1.1 kW induction motor confirm the validity of the proposed method. Furthermore, this method, which could help to develop diagnostics of broken bars and performance evaluation of induction motor, has great potential in future applications.

Finite-Element Analysis of Field Distribution and Characteristic Performance of Squirrel-Cage Induction Motor With Broken Bars

This paper develops the foundations of a technique for diagnosis and characterization of effects of broken bars in squirrel-cage induction motors based on the time-stepping coupled finite-element approach. These studies are performed by using the model to compute healthy case, one-broken-bar fault, and two adjacent broken bars fault performance data, which contains stator starting current waveforms, the current density on the bars, the magnetic force distribution on the rotor bars, and the distribution of magnetic field. Meanwhile, the iron core loss distributions on the rotor tooth adjacent to broken bars are computed, and the harmonic component of air-gap flux density is analyzed. From this data, the faulty signatures are extracted. Theoretical approach together with experimental results derived from a two-pole 1.1 kW induction motor confirms the validity of the proposed method. Furthermore, this method, which could help to develop diagnostics of broken bars and performance evaluation of induction motors, has great potential in future applications

Detection of Induction Motor Faults: A Comparison of Stator Current, Vibration and Acoustic Methods

In this paper we present the comparison results of induction motor fault detection using stator current, vibration, and acoustic methods. A broken rotor bar fault and a combination of bearing faults (inner race, outer race, and rolling element faults) were induced into variable speed three-phase induction motors. Both healthy and faulty signatures were acquired under different speed and load conditions. To address the detection capabilities of the above methods, comparisons are made in both the time and joint time-frequency domains. In the frequency domain, spectral differences are compared and characterized under constant speed conditions. To evaluate the detection sensitivities under non-stationary conditions (e.g. startup), a joint time-frequency method called the smoothed pseudo Wigner-Ville distribution (SPWVD) is employed to analyze non-stationary signatures. The SPWVD is a powerful technique for revealing non-stationary characteristics of motor signatures. Experimental results show that the stator current method is sensitive to the broken rotor bar fault while the vibration method is sensitive to bearing faults. The acoustic method is very attractive in that it contains less noise and interference within the analyzing frequency band. With the proper selection of monitoring and analysis methods, induction motor faults can be detected accurately under both stationary and non-stationary states.

Chinese Remaindering Based Cryptosystems in the Presence of Faults

We present some observations on public-key cryptosystems that use the Chinese remaindering algorithm. Our results imply that careless implementations of such systems could be vulnerable. Only one faulty signature, in some explained context, is enough to recover the secret key.

Scan-based BIST fault diagnosis

Existing built-in self-test (BIST) diagnostic techniques assume the existence of a few bit errors in a test response sequence. This assumption is unrealistic since in a BIST environment a single defect can usually cause hundreds or thousands of errors in a test response sequence. Without making the above assumption, this paper presents a novel BIST fault diagnostic technique for scan-based VLSI devices. Based on faulty signature information, our scheme guarantees correct identification of the scan flip-flops that capture errors during test, regardless of the number of errors the circuit may produce. In addition, it is able to identify failing test vectors with a better diagnostic capacity than existing techniques. The proposed scheme does not assume any specific fault model. Thus, it is applicable to all voltage-detectable faults. It also applies naturally to multifrequency BIST. This paper analyzes the efficiency of the scheme in terms of diagnostic coverage. Experimental results on several large ISCAS89 benchmark circuits and industrial circuits are also reported.

Multiple error detection and identification via signature analysis

Signature analysis has been used widely for fault detection as a part of Built-In Self Test (BIST). In this paper we show how signature analysis can be used not only for fault detection but also for identification of multiple errors produced by faults in the circuits under test. We construct Signature Analysis Registers (SARs) to detect and identify any specified number of errors in the input polynomials by choosing proper characteristic polynomials. To detect and identifyr errors in an input bit stream ofm bits, we use a polynomialg r (x)=1cm (f 1 (x), f 3 (x), ..., f 2r−1 (x)) as the characteristic polynomial for the SAR for any polynomialf 1 (x), where lcm represents the least common multiple of polynomials al $$fi(x) = Res_t (f_1 (t),x - t^i ), i = 3,...,2r - 1,$$ Res t denotes thet-Resultant, andm is less than the order off 1 (x). Given a faulty signature produced by an SAR constructed as described, we present an algorithm for the identification of the actual error bits in the input polynomial to the SAR. We also extend the use of BCH codes for error detection and correction to include nonprimitive polynomials.

On the relation of errors and its syndrome in signature analysis

This paper deals with fault diagnostics in signature analysis of computer hardware testing. When an incorrect signature is observed, it is often desired to identify the bit locations, within the input data stream, where errors have caused the faulty signature. One method is common use in the exhaustive matching test in which all bit locations of the input sequence are compared sequentially with the expected response. In this paper, an algorithm of fault diagnostics is presented by making use of the information from the faulty signature. The idea is to search the likely error locations before the tests are performed. The method reduces the number of tests required to diagnose the errors with the probability of aliasing. Such probability is always smaller than that of error detection in signature analysis. When matching tests are difficult or impossible, the method provides an estimate of where errors might have occurred that caused the incorrect signature. Also, the case of “don't cares” at the input sequence of signature analysis is discussed.

An investigation of the information contained in faulty signatures

This paper describes a new method of analyzing faulty signatures from both single input and multiple input signature registers (MISRs). In particular, the information contained in the faulty signature of an MISR is investigated. The matrix formulation presents an alternative method of determining the relationship between an error and its syndrome for diagnostic purposes. The results provide new insights into applying MISRs for Built-In Self Test.

An algorithm of diagnostics with signature analyzer

The study of faulty signature (checksum) in computer hardware testing is presented. When a faulty signature is observed, it is caused by one of many possible input sequences that contain errors at different locations. The faulty signature is analyzed in order to reduce the number of tests and simplify the fault-isolation process. It is found that the number of errors among the sequences is distributed with binomial characteristics. To support the analysis, a computer simulation is performed to analyze the distributions of undetected errors.< <ETX xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">&gt;</ETX>