Multidimensional Coupled Fault Injection and Key Recovery Attack on Automotive Security Chips

Fault injection is a critical technique for evaluating the physical security of cryptographic chips. However, most existing studies investigate only single-factor fault injection under standard laboratory environments, which fails to fully capture the threats arising from coupled multi-factor stresses in complex automotive environments. This paper proposes a theoretical model that characterizes the interaction among three fault factors, i.e., voltage glitch, clock glitch, and temperature, on automotive security modules. The model uses multiple linear regression with interaction and quadratic terms to capture both main effects and synergistic couplings. We validate the model through fault injection experiments on an SM4-implemented chip. Results show that higher temperatures lower the fault threshold for voltage and clock glitches. The proposed model provides a theoretical foundation and practical guidance for security risk assessment and security design of automotive cryptographic chips operating in real-world environments. We further demonstrate a differential fault analysis (DFA) attack on SM4 using the fault outputs induced by optimal parameter combinations, achieving full 32-bit round key recovery.