In-Situ FPGA Fault Injection with Short-Circuits

Fault injection (FI) causes intentional errors in the circuit for the benefit of the attacker. These faults are created, e.g., by briefly interrupting the power supply which creates a voltage glitch. Many real-world examples emphasize the importance to protect against voltage glitches and related techniques that rely on physical proximity. Unfortunately, design and testing of countermeasures is often a laborious process such that a vulnerable combination of parameters is easily missed. Ideally, this process could be simplified without compromising assurance. To meet this need and enable per-unit testing, we propose in-situ fault injection testing by leveraging configurable Short Circuits (SCs) inside the FPGA, i.e., without external equipment. In our work, we characterize these FPGA-internal short circuits using our high-resolution Time-to-Digital Converter (TDC), study their behavior under different configurations, and compare the results against other types of power wasting circuits that have been used in the literature. We then use a configurable number of SCs to inject faults into AES inside the same FPGA. The impact of this is as follows: with a TDC and SCs, we obtain a lab-on-a-chip with fault-injection (and side-channel) capabilities that could also be used to devastating effect in multi-tenant FPGA environments in the cloud.