Electromagnetic fault injection equipment

Abstract

The utility model discloses electromagnetic fault injection equipment, which relates to the technical field of fault injection equipment, and comprises a main control module, a voltage detection module, a boost power storage module, a pulse trigger module, a power storage capacitor and an EM probe, and is characterized in that the main control module is adaptively connected with the voltage detection module, the boost power storage module and the pulse trigger module; the boost power storage module and the voltage detection module are adaptively connected with the power storage capacitor, the power storage capacitor is adaptively connected with the EM probe, and the pulse trigger module is adaptively connected with the EM probe; the main control module is used for controlling the boost power storage module to charge the power storage capacitor; the voltage detection module is used for generating a detection signal according to the voltage at the two ends of the power storage capacitor and transmitting the detection signal to the main control module; based on the detection signal, the master control module controls the EM probe to inject electromagnetic pulses to the target device through the pulse trigger module. The electromagnetic fault injection device is simple in topological structure, small in size and convenient to carry and use.

Description

Technical Field

[0001] This utility model relates to the field of fault injection equipment technology, and in particular to an electromagnetic fault injection equipment. Background Technology

[0002] Fault injection devices are used for security testing. There are various fault injection attack methods, such as electromagnetic attacks, voltage glitches, temperature attacks, laser attacks, and clock attacks. Voltage glitches attack disrupt the external voltage to cause chip malfunction, making it easy to implement but unable to target a specific part. Most chips now have glitches, low-voltage resets, and power supply filtering to resist attacks, so this method is not suitable for newer chips. Clock attacks disrupt the chip by changing clock glitches, but many chips have their clocks internal, making clock injection impossible. Furthermore, clock injection requires analyzing the chip's bootloader assembly program to find vulnerabilities, making it inconvenient. Temperature attacks disrupt the chip's normal operation by changing the external temperature, causing it to malfunction and allowing data access through flash memory vulnerabilities. However, this method is generally only theoretically feasible; in practice, it's difficult to instantly reach the desired high temperature, missing the optimal injection opportunity. Laser or X-ray attacks use lasers or X-rays to disrupt the normal operation of the cryptographic chip with photons. It allows for selective attack location and is the most powerful attack method. Since chips are primarily protected on the front side, with little protection on the back, laser attacks are widely used in chip decryption and are a highly effective attack method. However, laser attacks suffer from drawbacks such as extremely high equipment costs, difficulty in effectively attacking non-top-layer devices, and irreversible damage to the chip. In contrast to the aforementioned injection attack methods, electromagnetic attacks have attracted widespread attention and research due to their simple principles, ease of implementation, good controllability, ability to easily penetrate various physical packaging barriers, and lack of irreversible damage to the chip.

[0003] Electromagnetic fault injection (EMFI) devices are used to inject electromagnetic energy into target devices. EMFI devices affect the target device through magnetic flux generated by an EM probe, causing fluctuations in the internal voltage and current to simulate transient faults caused by electromagnetic interference, thereby assessing the safety and reliability of electronic equipment. However, current EMFI devices suffer from problems such as large size, high power requirements, and inconvenient control. Utility Model Content

[0004] In response to the aforementioned problems and technical requirements, the applicant has proposed an electromagnetic fault injection device.

[0005] The technical solution of this utility model is as follows:

[0006] An electromagnetic fault injection device includes a main control module, a voltage detection module, a boost storage module, a pulse triggering module, a storage capacitor, and an EM probe.

[0007] The main control module is adapted and connected to the voltage detection module, the boost energy storage module and the pulse triggering module. The boost energy storage module and the voltage detection module are adapted and connected to the energy storage capacitor. The energy storage capacitor is adapted and connected to the EM probe. The pulse triggering module is adapted and connected to the EM probe.

[0008] The main control module is used to control the boost energy storage module to charge the energy storage capacitor. The voltage detection module is used to generate a detection signal based on the voltage across the energy storage capacitor and transmit it to the main control module. Based on the detection signal, the main control module controls the EM probe to inject electromagnetic pulses into the target device through the pulse triggering module.

[0009] A further technical solution is that the main control module includes a CPU, and the boost energy storage module includes a resistor R1, a switching transistor Q1, a diode D1, and a transformer T1, wherein...

[0010] The second electrode of the switching transistor Q1 is connected to the first signal pin of the CPU, the first electrode of the switching transistor Q1 is grounded, the third pin of the switching transistor Q1 is connected to one end of the primary winding of the transformer T1, the other end of the primary winding of the transformer T1 is connected to the positive terminal of the power supply through the resistor R1, and the negative terminal of the power supply is grounded.

[0011] One end of the secondary winding of transformer T1 is connected to the anode of diode D1, the cathode of diode D1 is connected to the positive terminal of the storage capacitor and one end of the EM probe, and the negative terminal of the storage capacitor is connected to the other end of the secondary winding of transformer T1.

[0012] A further technical solution is that the turns ratio of the primary winding to the secondary winding of transformer T1 is 1:10.

[0013] A further technical solution is that the pulse triggering module includes a switching transistor Q2, a switching transistor Q3, a transformer T2, resistors R2, R3, and R4, and a diode D2, wherein...

[0014] The second electrode of the switching transistor Q3 is connected to the second signal pin of the CPU, the first electrode of the switching transistor Q3 is grounded, the third electrode of the switching transistor Q3 is connected to one end of the primary winding of the transformer T2, and the other end of the primary winding of the transformer T2 is connected to the positive terminal of the power supply through resistor R2.

[0015] A further technical solution is that one end of the secondary winding of transformer T2 is connected to one end of resistor R3 and the anode of diode D2, and the other end of the secondary winding of transformer T2 is connected to the other end of resistor R3 and connected to the cathode of diode D2 and the second electrode of switching transistor Q2 through resistor R4.

[0016] The first electrode of the switching transistor Q2 is connected to the negative terminal of the storage capacitor, and the third electrode of the switching transistor Q2 is connected to the other end of the EM probe.

[0017] A further technical solution is that the voltage detection module includes resistors R5, R6, R7, and R8, as well as an optocoupler U1.

[0018] One end of resistor R5 is connected to the positive terminal of the storage capacitor, and the other end of resistor R5 is connected to the anode of the primary-side light-emitting diode of optocoupler U1. The negative terminal of the storage capacitor is connected to the cathode of the primary-side light-emitting diode of optocoupler U1. The collector of the secondary-side phototransistor of optocoupler U1 is connected to the power supply voltage through resistor R6 and is connected to one end of resistor R7. The other end of resistor R7 is connected to the detection signal receiving pin of the CPU and grounded through resistor R8. The emitter of the secondary-side phototransistor of optocoupler U1 is grounded.

[0019] A further technical solution is that the first signal pin of the CPU is used to output a first control signal to the switching transistor Q1, and the second signal pin of the CPU is used to output a second control signal to the switching transistor Q3; the first control signal is a PWM signal, and the second control signal is a pulse signal.

[0020] A further technical solution is that the switching transistors Q1 and Q3 are MOSFETs, and the switching transistor Q2 is an IGBT.

[0021] A further technical solution is that the main control module also includes a host computer connected to the CPU and multiple expansion ports connected to the CPU.

[0022] A further technical solution is that the main control module also includes an LED connected to the CPU, which is used to indicate the status of the detection signal.

[0023] The beneficial technical effects of this utility model are:

[0024] The electromagnetic fault injection device provided by this invention has a simple topology, low cost, and small size, making it easy to carry and use. Furthermore, this electromagnetic fault device only requires a 5V power supply, which can be supplied via the USB port of a host computer. A boost capacitor module can generate a 500V voltage across the capacitor, effectively causing a malfunction in the target device. In addition, this electromagnetic fault device has multiple expansion ports, which can be directly programmed and controlled in practical applications to run user logic, achieving more flexible control. Attached Figure Description

[0025] Figure 1 This is a topology block diagram of one embodiment of the electromagnetic fault injection device provided by this utility model.

[0026] Figure 2 This is a circuit diagram of one embodiment of the boost energy storage module provided by this utility model.

[0027] Figure 3 This is a circuit diagram of one embodiment of the pulse triggering module provided by this utility model.

[0028] Figure 4 This is a circuit diagram of one embodiment of the voltage detection module provided by this utility model.

[0029] Figure 5 This is a pin diagram of one embodiment of the CPU provided by this utility model.

[0030] Figure 6 This is a pin diagram of one embodiment of the power supply filtering circuit provided by this utility model. Detailed Implementation

[0031] The specific embodiments of this utility model will be further described below with reference to the accompanying drawings.

[0032] This utility model proposes an electromagnetic fault injection device, such as... Figure 1 As shown, the electromagnetic fault injection device includes a main control module, a voltage detection module, a boost energy storage module, a pulse triggering module, a storage capacitor, and an EM (Electromagnetic) probe. The main control module is adapted to and connected to the voltage detection module, the boost energy storage module, and the pulse triggering module. The boost energy storage module and the voltage detection module are adapted to and connected to the storage capacitor. The storage capacitor is adapted to and connected to the EM probe. The pulse triggering module is adapted to and connected to the EM probe.

[0033] The main control module is used to control the boost energy storage module to charge the energy storage capacitor. The voltage detection module is used to generate a detection signal based on the voltage across the energy storage capacitor and transmit it to the main control module. Based on the detection signal, the main control module controls the EM probe to inject electromagnetic pulses into the target device through the pulse triggering module.

[0034] Specifically, the main control module includes a CPU and a host computer. The CPU communicates with the host computer via a serial port. The host computer sends a start command to the CPU via the serial port. The CPU controls the boost battery module to charge the battery capacitor. The voltage detection module detects the charging status of the battery capacitor. When the voltage across the battery capacitor reaches the target charging voltage, the detection signal sent by the voltage detection module to the CPU is valid. At this time, the host computer can input an external trigger signal or command to control the CPU, causing the CPU to control the EM probe to inject electromagnetic pulses into the target device through the pulse trigger module. Alternatively, the CPU can be configured with operating logic so that when the CPU receives a valid detection signal, it automatically controls the EM probe to inject electromagnetic pulses into the target device through the pulse trigger module. The triggering time of the electromagnetic pulses can be controlled by either the host computer or the CPU's built-in operating logic, achieving precise control of the optimal timing for electromagnetic pulse injection. The specific forms and connection methods of the main control module, voltage detection module, boost battery module, and pulse trigger module are described below.

[0035] Furthermore, the boost energy storage module includes a resistor R1, a switching transistor Q1, a diode D1, and a transformer T1, wherein,

[0036] The second electrode of the switching transistor Q1 is connected to the first signal pin of the CPU, the first electrode of the switching transistor Q1 is grounded, the third pin of the switching transistor Q1 is connected to one end of the primary winding of the transformer T1, the other end of the primary winding of the transformer T1 is connected to the positive terminal of the power supply through the resistor R1, and the negative terminal of the power supply is grounded.

[0037] One end of the secondary winding of transformer T1 is connected to the anode of diode D1, the cathode of diode D1 is connected to the positive terminal of the storage capacitor and one end of the EM probe, and the negative terminal of the storage capacitor is connected to the other end of the secondary winding of transformer T1.

[0038] Specifically, Figure 2The circuit diagram of one embodiment of the boost-voltage energy storage module is shown. The turns ratio of the primary winding to the secondary winding of transformer T1 is 1:10, meaning transformer T1 is a boost transformer. The first signal pin of the CPU is used to output a first control signal to the second electrode of the switching transistor Q1. In this embodiment, the power supply is a 5V DC power supply. The first control signal is a PWM (Pulse Width Modulation) signal with a frequency of 2kHz and a duty cycle of 1.5%. The PWM signal controls the conduction state of the switching transistor Q1. When the switching transistor Q1 is on, the energy storage capacitor is charged through the secondary winding of transformer T1. Since the turns ratio of the primary winding to the secondary winding of transformer T1 is 1:10, the secondary winding can amplify the power supply voltage by 10 times, enabling rapid charging of the energy storage capacitor even with a small PWM signal duty cycle.

[0039] Furthermore, the pulse triggering module includes switching transistor Q2, switching transistor Q3, transformer T2, resistor R2, resistor R3, resistor R4, and diode D2, wherein,

[0040] The second electrode of the switching transistor Q3 is connected to the second signal pin of the CPU. The first electrode of the switching transistor Q3 is grounded. The third electrode of the switching transistor Q3 is connected to one end of the primary winding of the transformer T2. The other end of the primary winding of the transformer T2 is connected to the positive terminal of the power supply through resistor R2. One end of the secondary winding of the transformer T2 is connected to one end of resistor R3 and the anode of diode D2. The other end of the secondary winding of the transformer T2 is connected to the other end of resistor R3 and, through resistor R4, to the cathode of diode D2 and the second electrode of the switching transistor Q2. The first electrode of the switching transistor Q2 is connected to the negative terminal of the storage capacitor. The third electrode of the switching transistor Q2 is connected to the other end of the EM probe.

[0041] Specifically, the switching transistors Q1 and Q3 are N-type MOSFETs (Metal-Oxide-Semiconductor Field-Effect Transistors), and the switching transistor Q2 is an IGBT (Insulated-Gate Bipolar Transistor). For the MOSFET, the first electrode is the source, the second electrode is the gate, and the third electrode is the drain; for the IGBT, the first electrode is the emitter, the second electrode is the gate, and the third electrode is the collector. The second signal pin of the CPU is used to output a second control signal to the second electrode of the switching transistor Q3. In this embodiment, the second control signal is a pulse signal, and the output width and trigger polarity of the pulse signal can be set within the CPU. The pulse signal controls the conduction state of the switching transistor Q3 to control the voltage of the primary winding of the transformer T2. The transformer T2 provides electrical isolation. When the primary winding of the transformer T2 generates a voltage pulse, the secondary winding also generates a voltage pulse. This voltage pulse causes the switching transistor Q2 to conduct instantaneously, thereby forming a circuit between the storage capacitor and the EM probe. The EM probe converts the electric field into a magnetic field and releases energy to the target device, that is, injects an electromagnetic pulse into the target device.

[0042] Furthermore, to ensure that the energy storage capacitor is fully charged during device discharge, the device is also equipped with a voltage detection module. This voltage detection module includes resistors R5, R6, R7, and R8, as well as an optocoupler U1.

[0043] One end of resistor R5 is connected to the positive terminal of the storage capacitor, and the other end of resistor R5 is connected to the anode of the primary-side light-emitting diode of optocoupler U1. The negative terminal of the storage capacitor is connected to the cathode of the primary-side light-emitting diode of optocoupler U1. The collector of the secondary-side phototransistor of optocoupler U1 is connected to the power supply voltage through resistor R6 and is connected to one end of resistor R7. The other end of resistor R7 is connected to the detection signal receiving pin of the CPU and grounded through resistor R8. The emitter of the secondary-side phototransistor of optocoupler U1 is grounded.

[0044] Specifically, Figure 4The circuit diagram of one embodiment of the voltage detection module is shown. The resistance value of resistor R5 needs to be set according to the target charging voltage and the conduction current of optocoupler U1. When the voltage across the storage capacitor reaches the target charging voltage, the primary-side LED of optocoupler U1 conducts, thereby turning on the secondary-side phototransistor of optocoupler U1. The collector of the secondary-side phototransistor is pulled low to a low potential. At this time, the detection signal received by the CPU's detection signal receiving pin is a low level, i.e., an effective level. Conversely, when the voltage across the storage capacitor does not reach the target charging voltage, the primary-side LED of optocoupler U1 is turned off, and the secondary-side phototransistor of optocoupler U1 is also turned off. At this time, the detection signal received by the CPU's detection signal receiving pin is a high level. Transformers T1 and T2, as well as optocoupler U1, all serve as electrical isolation, completely isolating the low-voltage control section (i.e., the main control module) from the high-voltage section. This prevents the storage capacitor in the high-voltage section from affecting the operation of the low-voltage control section during charging and discharging, and also reduces the risk of electric shock during equipment use. In addition, since all components of this device are mounted on a PCB, the low-voltage control section and the high-voltage section must be isolated during the PCB layout design. The traces between the components in the high-voltage section should be shortened as much as possible so that electromagnetic pulses can be released from the EM probe.

[0045] In this embodiment, the main control module also includes an LED connected to the CPU. The LED is used to indicate the status of the detection signal; that is, when the CPU detects a low level detection signal, it controls the LED to light up. At this time, the user can determine whether the storage capacitor has finished charging by observing the LED. The main control module also includes multiple expansion ports connected to the CPU, including but not limited to ISP ports and SWD ports, which can be directly accessed by the user.

[0046] Figure 5 The diagram shows a pinout of one embodiment of the CPU, in which the CPU model can be STM32G431. Figure 5 The PA0 pin shown is the detection signal receiving pin, the PB5 pin is the first signal pin, and the PB3 pin is the second signal pin. The CPU chip's VDD pin is connected to a 3.3V power supply and is also connected to the power supply filter circuit. Figure 6 A circuit schematic diagram of one embodiment of a power supply filtering circuit is shown, including an electrolytic capacitor C24 and capacitors C25, C26 and C27 connected in parallel with the electrolytic capacitor C24. The positive terminal of the electrolytic capacitor C24 is connected to a 3.3V power supply, and the negative terminal of the electrolytic capacitor C24 is grounded.

[0047] The above descriptions are merely preferred embodiments of the present invention, and the present invention is not limited to the above embodiments. It is understood that other improvements and variations that can be directly derived or conceived by those skilled in the art without departing from the spirit and concept of the present invention should be considered to be included within the protection scope of the present invention.

Claims

1. An electromagnetic fault injection device, characterized in that, It includes a main control module, a voltage detection module, a boost energy storage module, a pulse trigger module, a storage capacitor, and an EM probe. The main control module is adapted and connected to the voltage detection module, the boost energy storage module and the pulse triggering module. The boost energy storage module and the voltage detection module are adapted and connected to the energy storage capacitor. The energy storage capacitor is adapted and connected to the EM probe. The pulse triggering module is adapted and connected to the EM probe. The main control module is used to control the boost energy storage module to charge the energy storage capacitor. The voltage detection module is used to generate a detection signal based on the voltage across the energy storage capacitor and transmit it to the main control module. Based on the detection signal, the main control module controls the EM probe to inject electromagnetic pulses into the target device through the pulse triggering module.

2. The electromagnetic fault injection device according to claim 1, characterized in that, The main control module includes a CPU, and the boost energy storage module includes a resistor R1, a switching transistor Q1, a diode D1, and a transformer T1. The second electrode of the switching transistor Q1 is connected to the first signal pin of the CPU, the first electrode of the switching transistor Q1 is grounded, the third pin of the switching transistor Q1 is connected to one end of the primary winding of the transformer T1, the other end of the primary winding of the transformer T1 is connected to the positive terminal of the power supply through the resistor R1, and the negative terminal of the power supply is grounded. One end of the secondary winding of transformer T1 is connected to the anode of diode D1, the cathode of diode D1 is connected to the positive terminal of the storage capacitor and one end of the EM probe, and the negative terminal of the storage capacitor is connected to the other end of the secondary winding of transformer T1.

3. The electromagnetic fault injection device according to claim 2, characterized in that, The turns ratio of the primary winding to the secondary winding of transformer T1 is 1:

10.

4. The electromagnetic fault injection device according to claim 2, characterized in that, The pulse triggering module includes switching transistor Q2, switching transistor Q3, transformer T2, resistor R2, resistor R3, resistor R4, and diode D2, wherein... The second electrode of the switching transistor Q3 is connected to the second signal pin of the CPU, the first electrode of the switching transistor Q3 is grounded, the third electrode of the switching transistor Q3 is connected to one end of the primary winding of the transformer T2, and the other end of the primary winding of the transformer T2 is connected to the positive terminal of the power supply through resistor R2.

5. The electromagnetic fault injection device according to claim 4, characterized in that, One end of the secondary winding of transformer T2 is connected to one end of resistor R3 and the anode of diode D2, and the other end of the secondary winding of transformer T2 is connected to the other end of resistor R3 and connected to the cathode of diode D2 and the second electrode of switching transistor Q2 through resistor R4. The first electrode of the switching transistor Q2 is connected to the negative terminal of the storage capacitor, and the third electrode of the switching transistor Q2 is connected to the other end of the EM probe.

6. The electromagnetic fault injection device according to claim 2, characterized in that, The voltage detection module includes resistors R5, R6, R7, and R8, as well as an optocoupler U1. One end of resistor R5 is connected to the positive terminal of the storage capacitor, and the other end of resistor R5 is connected to the anode of the primary-side light-emitting diode of optocoupler U1. The negative terminal of the storage capacitor is connected to the cathode of the primary-side light-emitting diode of optocoupler U1. The collector of the secondary-side phototransistor of optocoupler U1 is connected to the power supply voltage through resistor R6 and is connected to one end of resistor R7. The other end of resistor R7 is connected to the detection signal receiving pin of the CPU and grounded through resistor R8. The emitter of the secondary-side phototransistor of optocoupler U1 is grounded.

7. The electromagnetic fault injection device according to claim 4, characterized in that, The CPU's first signal pin is used to output a first control signal to the switching transistor Q1, and the CPU's second signal pin is used to output a second control signal to the switching transistor Q3; the first control signal is a PWM signal, and the second control signal is a pulse signal.

8. The electromagnetic fault injection device according to claim 4, characterized in that, The switching transistors Q1 and Q3 are MOSFETs, and the switching transistor Q2 is an IGBT.

9. The electromagnetic fault injection device according to claim 2, characterized in that, The main control module also includes a host computer connected to the CPU and multiple expansion ports connected to the CPU.

10. The electromagnetic fault injection device according to claim 2, characterized in that, The main control module also includes an LED connected to the CPU, which is used to indicate the status of the detection signal.

Images