Modeling Clock Glitch Fault Injection Effects on a RISC-V Microcontroller

Embedded systems face security concerns, vulnerable to physical attacks like fault injection. RISC-V processors are increasingly favored for their open-source architecture. In this article, we present practical fault models operating at the instruction encoding level, which effectively elucidate numerous observed faulty behaviors arising from clock glitch campaigns conducted on a 32-bit microcontroller (MCU) embedding a RISC-V core. We demonstrate that, owing to the variable-length encoding of instructions, the impact of these models at the execution level varies. Nevertheless, the proposed models consistently maintain their applicability irrespective of the encoding length. Furthermore, we illustrate that some of the observed faulty behaviors are comparable to those obtained when targeting Arm Cortex-M-based MCUs. In addition, we present new models that can explain new faulty behaviors. The presented models are able to explain more than $\mathbf{9 0} \%$ of the observed faulty behaviors.