Lightweight Countermeasures Against Original Linear Code Extraction Attacks on a RISC-V Core

Linear Code Extraction (LCE) is an invasive attack aiming at fully extracting a code from a device’s memory for reverse engineering purposes. The core instruction bus is identified and microprobed using Failure Analysis tools. Meanwhile, other microprobes force internal nodes of the core to logic states which allow a full memory linear extraction. This paper demonstrates the first assessment of a RISC-V core vulnerability to LCE. It evaluates the complexity to extract the code in the right order by freezing the instruction register or by editing the incoming instructions. This paper introduces three original countermeasures to detect an ongoing LCE by monitoring symptoms such as the lack of branch instruction execution. These hardware countermeasures are lightweight and adaptable to other core architectures. We develop an experimental setup based on a functional simulation framework and an FPGA-based demonstration. This setup made it possible to study and assess the LCE vulnerabilities of our RISC-V target and to validate the effectiveness of our proposed countermeasures. The area overhead was measured between 0.52% and 1.47% of the cv32e40p RISC-V core. Depending on the detection latency target, the clock cycle overhead using the Embench^TM benchmarks can be null or kept below 1%.

I. Introduction

Embedded systems execute applications stored in their memories. They may be the target of hardware or software attacks which aim to extract the application code. As introduced in [1, § 7.1], reverse engineering the code running on an Integrated Circuit (IC) is popular as it can lead to a profitable business. Manufacturers designing an IC based on a competitor's design reduce their development costs. Manufacturers may also sell low-cost devices which are compatible with a competitor's product. [2] discusses the fact that in the 90s, compatible pirate smart cards to access paid TV services were selling well. Now, peripheral devices as gamepad controllers or ink cartridges are the main targets such as they are increasingly widespread. Some well-funded and organized manufacturers such as Apex Microelectronics sell compatible ink cartridges [3].