16.5 A Synthesizable Design-Agnostic Timing Fault Injection Monitor Covering 2MHz to 1.26GHz Clocks in 65nm CMOS

Fault Injection Attacks (FIAs) are powerful attacks that induce and exploit faults in chips to create severe security consequences like faulty results, OS security bypass, and information leakage [1–3]. This paper focuses on low-cost FIAs that induce erroneous outputs by tampering with the clock signals and/or supply voltages via software and hardware exploits and/or physical interference (EM coupling, temperature, etc.). FIAs that directly flip bits through high-energy lasers, particles, or other advanced and costly means are out of our scope, but solutions on compact and standard-cell compatible detectors can be readily combined to complement our defense (like in [4]). We categorize FIA-induced clock glitches into 12 basic types (Fig. 16.5.1), where $\mathrm{T}_{1}-\mathrm{T}_{2}$ and $\mathrm{T}_{5}-\mathrm{T}_{12}$ aim at inducing error via timing violation, while $\mathrm{T}_{3}-\mathrm{T}_{4}$ induce errors by skipping the clock cycles of a partial computation block. These 12 types of glitch patterns form the basis for all conceivable clock faults. Existing chip-level FIA protections fall into two categories, logic checking [4] and physical anomaly detection [5]. An FIA-resistant AES engine that detects generic fault injections via optimized algorithmic check is reported in [4]. Porting this AES-specific approach elsewhere is complex, if not impossible. It also cannot fully cover laser FIA without distributed detectors. A design-agnostic clock glitch monitor that covers all types of glitches $(\mathrm{T}_{1}-\mathrm{T}_{12})$ by over-sampling the clock signals is presented in [5]. It requires a high-frequency FLL locked to multiples of the system clock frequency, which limits its detection precision, takes high power, and only works with slow clocks (i.e., <40 MHz in 5nm [5]). Its large area also restricts the number of instances on a chip so that it may not detect glitches at clock leaf nodes. It is worth mentioning that timing error detection circuits, like Razor [7], could be repurposed to detect certain FIA glitches that fall in its speculation window, but they cannot cover glitches such as pulse addition or cycle skipping $(\mathrm{T}_{1}-\mathrm{T}_{4})$ and come with excessive overhead when a large speculation window is needed to detect large deviations from the ideal clock $(\mathrm{T}_{5}-\mathrm{T}_{12})$.