InjectV: Modeling Fault Injection Attacks in RISC-V Simulation Environment
InjectV:在RISC-V仿真环境中建模故障注入攻击
Niccolò Lentini, Giorgio Fardo, Stefano Di Carlo, Alessandro Savino
AI总结 提出InjectV框架,基于gem5模拟器在RISC-V平台上实现精确、引导式的故障注入,支持寄存器和存储器瞬态故障攻击,实验表明相比传统方法节省95.8%时间。
详情
故障注入攻击(FIA)对硬件安全构成重大威胁,能够通过在计算或存储中诱导恶意故障来破坏系统。由于物理故障实验的高成本、复杂性和有限可用性,特别是在硅前开发阶段,评估对此类攻击的韧性具有挑战性。架构级仿真提供了一种面向开发者的白盒视角,用于系统性的漏洞评估。本文介绍了InjectV,一个基于gem5模拟器构建的RISC-V平台故障注入攻击框架。InjectV能够在安全关键执行点(如控制流决策、计数器和比较)实现精确、引导式的故障注入,从而系统性地探索攻击向量。它目前支持寄存器和存储器中的瞬态故障攻击,拓宽了模拟多种攻击场景的能力。在FISSC套件(包括VerifyPIN应用的强化变体)的安全基准测试上的实验结果表明,InjectV能够有效识别故障注入点,相比传统故障注入方法节省了95.8%的时间。
Fault Injection Attacks (FIAs) are a significant threat to hardware security, capable of compromising systems by inducing malicious faults in computation or storage. Evaluating resilience against such attacks is challenging due to the high cost, complexity, and limited availability of physical fault experiments, particularly during pre-silicon development. Architectural-level simulation offers a developer-oriented, white-box perspective for systematic vulnerability assessment. This paper introduces InjectV, a fault injection attack framework for RISC-V platforms built on the gem5 simulator. InjectV enables precise, guided fault injection at security-critical execution points, such as control-flow decisions, counters, and comparisons, allowing systematic exploration of attack vectors. It currently supports transient fault attacks in registers and memory, broadening its ability to simulate diverse attack scenarios. Experimental results on security benchmarks from the FISSC suite, including hardened variants of the VerifyPIN application, demonstrate InjectV's ability to effectively identify fault-injection points, achieving a 95.8% time-saving advantage over traditional fault injection approaches.