Random-Delay Lockstep Redundancy for Fault Injection Defense
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current redundancy systems in automotive electronics lack sufficient security against fault injection attacks, which can compromise functional safety and cybersecurity by allowing attackers to deduce information about cryptographic keys through maliciously introduced errors.
Innovation Solution
A dual modular redundancy (DMR) system with lockstep logic blocks, random delays, and a random output selector is implemented to detect faults and prevent attacks, ensuring both functional safety and cybersecurity by comparing outputs from identical logic blocks with staggered delays and randomizing outputs to hinder attackers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If redundancy is implemented by providing two separate sensors for measuring the same physical quantity, then functional safety is improved, but device complexity increases
Solution Approach 1:
The system is divided into multiple identical logic blocks that perform the same function independently. Each block processes inputs separately and produces outputs that are compared by a fault detection circuit, enabling redundancy without requiring fundamentally different sensor types.
Solution Approach 2:
Multiple identical logic blocks are combined in parallel to achieve redundancy. The blocks share the same input signals and are structured identically, merging their computational resources while maintaining independent operation for fault detection purposes.
2Object-affected harmful factors
If random delays are introduced to prevent fault injection attacks, then cybersecurity is improved, but timing precision deteriorates
Solution Approach 1:
The delay values are made dynamic and random rather than fixed. Random delay circuits introduce variable time delays to signal paths, making it difficult for attackers to predict when faults will be injected or detected, thereby enhancing security against timing-based attacks.
Solution Approach 2:
The delay parameter is changed from a fixed value to a random variable. By varying the delay time randomly, the system prevents attackers from exploiting precise timing information while still maintaining the functional integrity of the redundancy comparison.
3Measurement precision
If outputs from multiple logic blocks are compared continuously, then fault detection capability is improved, but processing speed deteriorates
Solution Approach 1:
Instead of continuous comparison, the system uses periodic sampling of outputs from multiple logic blocks. The fault detection circuit compares outputs at specific intervals, reducing the processing burden while maintaining effective fault detection capability through regular monitoring.
Data Source
AI summary
A redundancy system includes a first computational device and a second computational device each configured to receive at least one input and to generate a first output and a second output, respectively, based on the at least one input; a random sequence generator configured to generate a random bit sequence; a random delay selector configured to determine a random delay based on the random bit sequence; a first random delay circuit configured to delay outputting the at least one input to the first computational device based on the random delay; a second random delay circuit configured to delay outputting the second output based on the random delay; and a fault detection circuit configured to receive the first output and the delayed second output, and to generate a comparison result based on comparing the first input to the delayed second output.