# Active Shielding Against Physical Attacks by Observation and Fault Injection: ChaXa

Clément Gaine, Jean-Pierre Nikolovski, Driss Aboulkassimi, Jean-Max
Dutertre

► To cite this version:

Clément Gaine, Jean-Pierre Nikolovski, Driss Aboulkassimi, Jean-Max Dutertre. Active Shielding Against Physical Attacks by Observation and Fault Injection: ChaXa. Journal Hardware and Systems Security, 2023, 7 (1), pp.1-10. 10.1007/s41635-023-00131-5 . cea-04663954

HAL Id: cea-04663954

https://cea.hal.science/cea-04663954v1

Submitted on 29 Jul 2024

**HAL** is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Active Shielding Against Physical Attacks by Observation and Fault Injection: ChaXa

Clément Gaine<fnref n="1" />,<fnref n="2" />,✉ Jean-Pierre Nikolovski<fnref n="1" />,<fnref n="2" />, Driss Aboulkassimi<fnref n="1" />,<fnref n="2" />, Jean-Max Dutertre<fnref n="3" />

Received: 25 May 2022 / Accepted: 26 January 2023 / Published online: 10 February 2023
© The Author(s), under exclusive licence to Springer Nature Switzerland AG 2023

## Abstract

Electronic components may contain sensitive data, either on the storage chip or on the microprocessor. Deliberate and precise perturbation of their operation or measurement of their activity through auxiliary channels can be used to extract the secrets they contain. For these reasons, it is important that the integrity of the integrated circuit is ensured. It is therefore necessary to implement protection mechanisms against threats such as physical attacks. In this paper, we present a new device for protection against and supervision of fault injection and electromagnetic listening attacks. It allows the detection of several types of physical attacks and provides an appropriate response for each type of threat.

**Keywords** Hardware security · Fault injection · Side-channel attacks · Countermeasure

## 1 Introduction

Integrated circuits use cryptographic algorithms to secure their operations and communications. These algorithms are mathematically secure and standardized [1, 2]. However, they are vulnerable to physical attacks on their implementation when used in circuits. Physical attacks can allow an attacker to extract the secret cryptographic keys used by an integrated circuit [3]. These physical attacks, which require direct physical access to the target, are of two types: observation attacks and disruption attacks.

ChaXa: A new approach for hardware protection.

<figure><img src="image_2.png" /></figure>

Clément Gaine
c.gaine@emse.fr; clement.gaine@gmail.com

Jean-Pierre Nikolovski
jean-pierre.nikolovski@cea.fr

Driss Aboulkassimi
driss.aboulkassimi@cea.fr

Jean-Max Dutertre
dutertre@emse.fr

### 1.1 Observation Attacks

In practice, the manipulated data switches logic gates at the chip level. If the manipulated values depend on the secret key, then it may be possible to perform a correlation power analysis (CPA) attack [4]. This is done by measuring the electromagnetic field emitted by the chip during several encryptions. These measurements are performed via an electromagnetic listening probe, as shown in Fig. 1. Assumptions on the manipulated values are made in order to calculate their current emissions according to a theoretical model. The attacker is then able to fully recover the encryption key used.

Several countermeasures in the field of observation attacks consist in masking the information (i.e., modifying the algorithm so that the variables are independent of the secret key) or hiding it (i.e., generating noise). We are mainly interested in countermeasures that require the fewest modifications of the code to be protected. Liu et al. [5] has for example proposed an adaptive noise generator against side-channel listening attacks on an ARM platform. It is based on flushing and reloading a cache memory. This countermeasure overloads system performance by less than 5% and reduces the effectiveness of side-channel listening to 70%.

To the best of our knowledge, there is no active protection providing side-channel shielding.

<footnote n="1">¹ Univ. Grenoble Alpes, CEA, Leti, F-38000 Grenoble, France</footnote>

<footnote n="2">² CEA-Leti, Centre CMP, Equipe Commune CEA Leti- Mines Saint-Etienne, F – 13541 Gardanne, France</footnote>

<footnote n="3">³ Mines Saint-Etienne, CEA, Leti, Centre CMP, F – 13541 Gardanne, France</footnote>
<figure><img src="image_3.png" /><figcaption>Fig. 1 Schematic of an electromagnetic listening and fault injection bench</figcaption></figure>

## 1.2 Fault Injection Attacks

The operation of a circuit can also be disrupted by acting on its environment. For example, the supply voltages can be modified in order to corrupt the execution of the instructions of a system. In the case of a microcontroller or processor, the consequence of the disturbance can be the non-execution of one or more instructions. The missing instructions then create errors (also called faults) in the calculations of the targeted algorithm. This type of disturbance is achieved by generating electromagnetic disturbances near the component [6] or by illuminating it with a laser [7]. Figure 1 is a representation of the electromagnetic injection bench.

An electromagnetic attack probe consists of a ferrite core with a copper wire wound around it. The latter realizes a coupling by inductive effect with the circuit under attack which creates the disturbance and a fault.

Fault injection protection can be implemented in software, for example by duplicating and checking the instructions [8]. However, we are looking here for a solution that can also be integrated into an existing device and does not require any modification of the software code. For this purpose, there are two types of protection, consisting of:

* Blocking the attack path: a shield is made which will block the physical mechanism causing the attack or

* Detecting the attack by monitoring environmental parameters via an electromagnetic or laser disturbance sensor, for example.

Protection against electromagnetic injections by shielding is well known to hardware security experts and is the subject of scientific publications and patents. The same

applies to the detection of attacks, particularly by disruption using electromagnetic pulses. Nevertheless, the combination of the two principles in a single device such as the one presented here is innovative.

Electromagnetic shielding devices are mainly designed to protect against electromagnetic interference and not against fault injection attacks. However, there is a Gemplus patent [9] registered in 2006 which proposes a device to protect an electronic component against attacks. The circuit is encapsulated by a material with random variations in refractive index. The material thus allows any electromagnetic attack pulse to be temporally deformed, so as to reduce its temporal locality. Effectiveness is relative insofar as the protection is only passive; it does not make it possible to detect an attack.

Various electromagnetic pulse detectors have been built using reconfigurable logic elements (FPGAs). For example, Guillaume-Sage et al. [10] developed a sensor to detect supply voltage and electromagnetic disturbances. However, the variations are concentrated in small areas, so it is necessary to use several sensors to cover the surface of the circuit. El-Baze et al. [11] developed a fully digital sensor using 5-D flip-flops. He showed that the detector was also effective in detecting body-biasing injections. Miura et al. [12] designed a sensor that exploits the fact that a disturbance changes the phase and frequency of the internal clock of the target circuit, which results in the unlocking of the phase-locked loop (PLL) and thus the detection of the disturbance. Breier et al. [13] uses a Hogge phase detector and a ring-oscillator to capture the frequency changes induced by electromagnetic waves.

Homma et al. [14] presents a slightly more complete protection against both fault injection and side-channel listening by using a dual-coil sensor. When approaching an inductive effect attack probe, the probe couples to a sensor coil arranged on the surface of the circuit to be protected. The maximum coupling is obtained when the two coils are in the same plane, so the mutual inductance that is created has a maximum value and provides information on the approach of the attack probe. However, it does not provide shielding, nor a means of reducing the magnitude of the magnetic induction, nor check the integrity of the protection device, so that, in the case of high-intensity attacks, the detection coil can become a source of perturbation, which can damage or fault the circuit under protection by induction in the electrical supply networks of the circuit.

One way to provide shielding protection against laser fault injections is to add a metal layer on the component as shown by Anderson et al. [15]. However, this solution is only viable on the front side. On the backside, NIR lasers can penetrate the silicon substrate and create faults.
## 1.3 Reverse Engineering Attacks

Components can be analyzed to determine their function and means of protection. These techniques may require the abrasion of the encapsulating material in order to perform microscopic or probing analysis. It is therefore important to verify the integrity of the target circuit in order to guarantee the confidentiality and integrity of the data manipulated.

Sharhrjerdi et al. [16] developed an electronic component, based on two sensors, against reverse engineering and fault injection attacks. It makes use of photodetectors at the IC level to detect threshold illumination and micro- or nano-piezoelectric beam sensors mounted on the IC sensitive to vibrations induced by mechanical abrasion processes. The first device consists of photovoltaic elements that will absorb incident radiation and generate photovoltaic energy. This will trigger the erasure of the circuit to prevent an attacker from stealing confidential information. The second device consists of a cantilevered micro-electromechanical system that converts mechanical vibrations into electrical energy and can trigger the erasure of the circuit.

Intrusive attacks can be detected by adding independent mesh lines in parallel and verifying data corruption between the transmitted and received data. For example, Briais et al. [17] injects random sequences of bits in the top layer and checks that they arrive unaltered after their journey in the said layer, while Ngo et al. [18] encrypts signals on the topmost metal layer.

# 2 Description of the ChaXa Device

## 2.1 Generalized Countermeasure

There are different devices for protecting circuits, but none of them is combined in a single unit. In order to better protect them against different types of attacks, it is currently necessary to provide different complementary and compatible devices. In this context, we propose a single device that can simultaneously achieve:

* Passive shielding which attenuates the electromagnetic leakage and the effect of the electromagnetic or laser perturbation.

* Active detection of electromagnetic listening attacks when approaching a listening probe.

* Active jamming against electromagnetic listening attacks.

* Active detection of electromagnetic fault injection attacks when approaching an attack probe and an electromagnetic shot.

* Intrusion detection and reverse engineering protection by providing its own supervision. Probing or modifying the circuit during its operation is not feasible.

Current sensors are mainly used to protect the front side of components, but the backside can also be attacked. This device, which has been tested and is functional, makes it possible to protect both sides.

In science fiction, notably the X-Men from the Marvel universe of comic books [19], the enemy Magneto controls magnetism while Professor Charles Xavier seeks to counter it in order to protect humanity. Charles Xavier is also able to detect the presence and intentions of other mutants and counter them in superhuman ways. A nod to this universe is made here by naming the new countermeasure device ChaXa.

## 2.2 Operating Principle

The operating principle of the device for protection and supervision against physical attacks in general is illustrated in Fig. 2a. It consists in depositing a polymer loaded with ferrite particles on the target surface. At both ends of the ferrite, transmitting and receiving probes are positioned. This allows the design of a thin injection/listening system. The transmitting probe produces a disturbance which is then transmitted by transient magnetic flux through the ferrite particles covering the circuit under protection to the listening probe.

The polymer charged with ferrite particles acts as a shield that attenuates the electromagnetic waves passing through it. During an electromagnetic side-channel attack, this shielding reduces the intensity of the electromagnetic radiation coming from the circuit to be measured, making it more difficult to perform the attack. It also makes it possible, in the case of an electromagnetic fault injection, to reduce the electromagnetic perturbation in order to make the fault injection ineffective. The transmitting electromagnetic probe combined with the device generates a periodic electromagnetic flow which is picked up by the receiving electromagnetic probe. This active part of the device allows the detection of the approach of a probe with a ferrite core (listening or attack) and also any impairment of the device carried out in order to make it lose its properties.

The device above the target circuit can be seen in Fig. 2b, which shows the ferrite with its two coils as well as an electromagnetic listening probe.

The transmitting and receiving coils have a number of turns between 1 and 10, but the efficiency is maximum for a number of 2 to 3 turns for the first and 2 to 5 for the second. The prototype was made with a 40-µm diameter wire, with the turns placed as closely together as possible, typically a few tens of micrometers.
<figure><img src="image_4.png" /><figcaption>**Fig. 2** *a* Illustration of the architecture of the ChaXa countermeasure device. *b* ChaXa protection device placed on top of a microcontroller during an electromagnetic listening attack. *c* Schematic representation of the protection and supervision device</figcaption></figure>

## 2.3 Electrical Schematic Diagram of the Device

The schematic representation in Fig. 2c illustrates the device for supervision and protection of an integrated circuit against attacks by electromagnetic injection and listening. The device is composed of:

* At least one sheet or layer of ferrite made of an iron oxide, nickel-zinc, or manganese-zinc alloy

* An emitter stage, noted E on the Fig. 2c, connected to the emitter coil and adapted to emit pulses of electric current into the emitter coil

* A receiving stage, noted R on the Fig. 2c, connected to the receiving coil and adapted to detect the peak amplitude of the electric voltage generated by the transient magnetic flux across the receiving coil

* An analog/digital converter, connected to the receiver stage to inform the electronic system and/or other microcontroller, via a bus, of the variations in the peak amplitude across the receiver coil

* A microcontroller-based management electronics noted μC.

The transmitter stage is mainly composed of a transistor that triggers the generation of pulses. A GPIO port controls the closing of the transistor in order to generate a current variation $\frac{di}{dt}$ which generates a transient magnetic flux $\frac{dB}{dt}S$ (where S is the vertical section of the coil) in the emission coil.

The receiving stage is mainly composed of a resistor and a capacitor. The receiver coil collects the magnetic flux and produces an electromotive force. This force is rectified by a diode and is used to charge a reservoir capacitor. The magnetic flux received at the receiver coil is measured by measuring the voltage across the resistor and capacitor. This

value is relative to the amplitude of the received signals. Diodes, not shown in the diagram, are used to limit the effect of voltage spikes across the receiver coil, in the event that an attacker fires an electromagnetic shot near the coil.

# 3 Proof of Concept

The proof of concept of the device consists in verifying that it detects a violation of the target's integrity and that it protects against attacks by perturbation and observation. All the results presented below were obtained through experiments.

## 3.1 Supervision

### 3.1.1 Integrity Check

One of the primary functions of the device is to protect the circuit from reverse engineering; this is done by checking the case for damage. To do this, the electromagnetic continuity between the two coils is checked regularly to detect any alteration. These checks are made at random times to limit the risk of probing attacks. Figure 3a shows the GPIO port controlling the generation of current pulses and the discharge of the capacitor connected to the reception probe.

We can therefore check that there is a transmission of magnetic flux from the transmitting coil to the receiving coil.

An attacker could try to drill into the ferrite to approach the probe and eliminate the shielding effect. This has the effect of damaging the shielding. Figure 4 shows the effect of various degrees of degradation of the ferrite foil on the receiving amplitude of the rectified signal across the capacitor.

<figure><img src="image_5.png" /></figure>
<figure><img src="image_6.png" /><figcaption>Fig. 3 Integrity check: normal state (a) and presence of a ferrite (b)</figcaption></figure>

A cutoff smaller than 0.5\*1 mm is detectable by the supervisory microcontroller, which can inform the target microcontroller via UART communication. Measures can then be taken to protect the circuit. The device is therefore able to detect a change in its own integrity.

### 3.1.2 Environment Check

In order to protect the circuit from electromagnetic side-channel analysis (EMA) and electromagnetic injection (EMFI), the integrity check process is also designed to detect the presence of a ferrite-based spy probe.

If a ferrite is present, the power of the electromagnetic flux transmitted between the two coils is reduced due to a

mutual inductance that is established with the probe (injection or listening) and that disturbs the incident flux.

In a similar way to Fig. 3a, Fig. 3b shows the GPIO port (A0), the discharge of the capacitor (A1), and the voltage at the terminals of the receiving coil. However, in this figure, a 1-mm diameter ferrite probe is in contact with the shield ferrite. This may represent the approach of a listening or injecting device during an attack attempt.

It can be seen that the voltage measured at the terminals of the capacitor (A1) is much lower than in the case of nominal operation. The value of the measured voltage decreases from 2.2 to 1.0 V. The device can detect the approach of a 1-mm diameter ferrite probe at a maximum distance of 1 mm.

<caption>Fig. 4 Evolution of ferrite sheet degradation</caption>

<figure><img src="image_7.png" /><figcaption>Voltage variation according to cutoff of ferromagnetic shielding layer</figcaption></figure>
Detection was verified over a temperature range of 25 to 70 °C. There is some deviation in the measurements but this does not prevent the presence of an attack or listening probe being detected. The device is therefore capable of detecting the presence of a ferromagnetic ferrite attack or injection probe for circuit temperatures ranging from 25 to 70 °C.

## 3.2 Protection Against Fault Injections

Attacks by fault injection disturb the operation of a circuit. The aim is thus to protect the components against these attacks, whether they are of the electromagnetic or laser type.

### 3.2.1 Fault Injection by Electromagnetic Pulse

**Electromagnetic Shielding** Shielding must protect against electromagnetic fault injections. To demonstrate the effectiveness of shielding, an experiment was carried out both on decapsulated ATmega328p microcontroller and microprocessor. The execution of the running code is likely to be faulted as soon as the voltage delivered to the terminals of the attack coil is higher than 90 V for the microcontroller.

When the surface of the target microcontroller was covered by a ferrite foil, it was not possible to fault the ATmega for delivered voltages up to 550 V. It can therefore be concluded that the shielding introduces a protection against electromagnetic injections of at least a factor $550/90 = 6$ (or 15.7 dB) on the amplitude of the voltage pulse generating the perturbation.

**Electromagnetic Injection Detection** The detection of an attack by electromagnetic injection can be carried out at 2 levels, at the time of the approach of a probe and at the time of the electromagnetic pulse generated by the probe.

In the second case, when the electromagnetic pulse is generated, a magnetic flux is emitted at the attack ferrite location and couples by mutual inductance with the ferrite foil. The latter transmits this perturbation by inductive guidance to the ChaXa receiver coil. These signals induced across the receiver coil have the effect of charging the monitoring tank capacitor and changing the nominal threshold voltage normally measured across it. Figure 5 shows the effect of the electromagnetic pulse on the voltage across the capacitor for different voltages. To do this, we use an electromagnetic fault injection bench consisting of a voltage pulse generator and an injection probe.

It can be seen that the response evolves with the intensity of the disturbance and that it is detectable by monitoring the voltage variations across the capacitor. A signal generated by a pulse generator with a voltage of 80 V in an injection probe is detected by the receiver coil. It will therefore be possible to detect all perturbations above this value. It has been shown previously that a voltage of 400 V does not fault the

<figure><img src="image_8.png" /><figcaption>Fig. 5 Effect of 100 V and 400 V amplitude electromagnetic pulses on the rectified output voltage of the receiver coil</figcaption></figure>

target microcontroller. The device therefore not only detects electromagnetic injection attempts but does so at voltages well below the first corruption threshold of normal operation of the circuit.

This protection against attacks by electromagnetic fault injection has a double effect. On the one hand, the shielding forces the attacker to increase the level of perturbation applied and, on the other, the perturbation is detected.

### 3.2.2 Laser Fault Injection

**Laser Shielding** The presence of an opaque ferrite sheet prevents the signals produced by a laser from passing through it. To perform a laser fault injection, an attacker would therefore have to remove the device in order to expose the silicon chip. However, it has been shown in Sect. 3.1.1 that the device is capable of detecting any change in its integrity. The device therefore provides protection against laser fault injection attacks.

## 3.3 Side-Channel Protection

The aim is to protect the components against side-channel attacks which allow the keys of an encryption algorithm to be recovered. The presence of a layer of ferrite forms a first level of protection by passive shielding. In parallel, the transmitting coil can also be used to generate active noise against side-channel listening. The acquisition of electromagnetic emanations from the microcontroller is done using a Langer RF-U 5–2 probe and a Langer PA306 amplifier. An output port on the microcontroller allows the acquisition to be triggered through synchronization with the AES.

A correlation power analysis (CPA) uses statistical tools to derive secret keys by correlating assumed leakage hypotheses

<figure><img src="image_9.png" /></figure>
<figure><img src="image_10.png" /><figcaption>**Fig. 6** Electromagnetic signal plot and result of the CPA on byte 15 for the reference signal (a), passive shielding (b), and active interference (c)</figcaption></figure>
with a set of experimental acquisitions. The Pearson correla-
tion coefficient between the model and the measured data can
be calculated in order to estimate the most likely manipulated
value. In this study, a CPA is performed on the 1st round of
the AES and targets the output of the SubBytes function.

3.3.1 Functioning Without Protection

The effectiveness of these measures against side-channel
listening is tested on a AES software running on an
ATmega328p at a clock rate of 16 MHz. The electromag-
netic emanations of the microcontroller are represented in
Fig. 6a. A CPA is performed to find the secret key of the
AES. Figure 6a shows the correlation of each key candidate
as a function of the number of acquisitions analyzed for two
bytes of the key. It has been chosen to represent the best
evolution of the correlation. The correlation coefficients
obtained vary from 0.78 to 0.93 and CPA makes it possible
to find the encryption key with the help of about 30 acquisi-
tions. The attack is successful after a handling time of less
than 1 min (35 s).

3.3.2 Passive Shielding

In order to test the passive shielding, a ferrite sheet is
inserted between the microcontroller and the listening probe.
Figure 6b represents the signal measured at the output of
the amplifier. Attenuation of the amplitude of the received
signal (from 150 to 40 mV) is observed. A CPA analysis is
performed using 3500 acquisitions, and the evolution of the
correlation for one bytes of the key is represented in Fig. 6b.
The correlation coefficients obtained vary from 0.09 to 0.14,
whereas they were 7 times higher without protection. But,
by studying the progression of the correlation coefficient,
the encryption key can be found with the help of about 2500
acquisitions. The attack is therefore successful after a han-
dling time of 35 min, which is 80 times longer than without
protection. The passive effect of the shielding thus provides
protection against side-channel listening attacks.

3.3.3 Active Shielding

In order to generate active shielding, a port on the supervisory
microcontroller is connected to the transmitting coil and is
continuously toggled (switched from high to low and back
again) during the critical code. This generates a strong elec-
tromagnetic field that interferes with side-channel listening.
During this phase, the current consumption is 70 mA while it
is 7 mA in conventional operation. In our case, it was chosen
to limit this interference phase to the 1st round of the AES.

Figure 6c represents the signal measured at the output of
the amplifier.

Signals with an amplitude of 2.5 V are observed, compared
to 40 mV in the case of passive shielding. The generation of
the noise is desynchronized from the execution of the AES
algorithm, which prevents an attacker from being informed of
the start of the execution of the AES code. A CPA is carried
out using 135,000 acquisitions, which corresponds to an acqui-
sition time of 24 h. Figure 6c shows the correlation of each key
candidate as a function of the number of acquisitions analyzed
for one byte of the key. The correlation coefficients obtained
vary from 0.008 to 0.012, and the progression of the correla-
tion coefficient is divided among all the candidate keys. The
CPA does not find a byte of the encryption key. The manipu-
lation time is about 40 h. The attack therefore takes at least a
factor of 4000 longer to complete than for the unshielded target
and 40 longer than for the passively shielded target.

The previously performed CPA is no longer able to find
the encryption key with the random electromagnetic noise
protection. The fast Fourier transform (FFT) of the signals
with the active shielding and without the shielding high-
lights a peak at 16 MHz corresponding to the operating fre-
quency of the ATmega. The emissions due to the shielding
are present at a frequency of 10 MHz and its harmonics. This
corresponds to the switching frequency of the microcon-
troller output generating the interference. Two solutions can
be considered to limit the effect of the interference and to
preserve the leakage of the AES. On the one hand, band-pass
filtering between 10 and 20 MHz can be performed, which
allows the leaks to be kept if their frequency is close to the
circuit operating frequency. On the other hand, we can carry
out low-pass filtering with a cutoff frequency of 17 MHz if
the frequency of the leaks is lower than that of the circuit.
The interference part of the signal is sharply reduced in both
cases. Some advanced CPA are then performed on 135,000
filtered plots. Despite these procedures, it was not possible
to find an encryption key.

The combination of passive shielding and active interfer-
ence is therefore effective against more complex electromag-
netic side-channel attacks. On a microprocessor, the results
are similar. Thirty thousand unshielded acquisitions are
required to retrieve the encryption key, while it is impossi-
ble to retrieve them with one million acquisitions with active
interference, even with filtering.

4 Conclusion

We have described the operation of a new protection sys-
tem called “ChaXa” and its efficiency was ascertained
through experimental results. This integrated circuit
supervision device, patented by the CEA in January 2021,
aims to address the security of electromagnetic fault injec-
tion attacks. We have demonstrated the effectiveness of
ChaXa by designing a compact prototype implementing

<figure><img src="image_11.png" /></figure>
the electronic schematic diagram. Although this protection
can be integrated into the packaging phase, the prototype
is proposed as a stand-alone add-on system that is glued
to the surface of the target to be protected, in this case a
microcontroller. We implemented the test and supervision
system with a communication protocol between the target
and ChaXa based on a UART communication, and protec-
tion supervision software executed by the microcontroller
and microprocessor. This communication can be considered
as the weak link of the protection. But, in practice, the target
under protection can also take care of the supervision and
the interpretation of the signals coming from the transmis-
sion/reception system. Finally, ChaXa can also ensure its
self-protection by controlling its physical integrity. We sum-
marize below the exhaustive list of the numerous protections
against physical attacks provided by ChaXa:

* Against attacks by electromagnetic injections:

- Passive shielding based on the ferromagnetic layer against electromagnetic pulse injection

- Detecting the presence of a ferrite-based passive electromagnetic probe

- Detection of electromagnetic pulse attacks

* Against attacks by laser injections:

- Passive shielding based on opaque ferrite sheet

* Against attacks by auxiliary channels:

- Passive shielding to attenuate the electromagnetic field from the target

- Detecting the presence of a ferrite-based probe

- Electromagnetic noise generator to interfere with electromagnetic field measurements

* Countermeasure protection:

- Dynamic verification of the integrity of the ferro-magnetic layer

- Reverse intrusion detection

Statements and Declarations

**Conflict of Interest** The authors declare no competing interests.

**Data Availability** The datasets generated during and/or analyzed during the current study are available from the corresponding author on reasonable request.

References

1. NIST/ITL/CSD, “Advanced Encryption Standard (AES). FIPS PUB 197,”Nov 2001, http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.197.pdf (alsoISO/IEC 18033-3:2010).

2. NIST/ITL/CSD, “Digital Signature Standard (DSS). FIPS PUB 186,”July 2013, https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf

3. Longo J, Mulder ED, Tunstall M (2015) SoC it to EM: electromagnetic side-channel attacks on a complex system-on-chip. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol 9293. Springer, pp 620–640

4. Brier E, Clavier C, Olivier F (2004) Correlation power analysis with a leakage model. Proc of Cryptographic Hardware and Embedded Systems, vol 3156. Springer, pp 16–29

5. Liu N, Zang W, Chen S, Yu M, Sandhu R (2019) Adaptive noise injection against side-channel attacks on ARM platform. ICST Trans Secur Saf 6:159346

6. Dehbaoui A, Dutertre J-M, Robisson B, Tria A (2012) Electromagnetic transient faults injection on a hardware and a software implementations of AES. 2012 Workshop on Fault Diagnosis and Tolerance in Cryptography. IEEE, Leuven, Belgium, pp 7–15

7. Colombier B, Menu A, Dutertre J-M, Moëllc P-A, Rigaud J-B, Danger J-L (2018) Laser-induced single-bit faults in flash memory: instructions corruption on a 32-bit microcontroller. 2019 IEEE International Symposium on Hardware Oriented Security and Trust (HOST). IEEE (Cryptology ePrint Archive: article 2018/1042)

8. Barenghi A, Breveglieri L, Koren I, Pelosi G, Regazzoni F (2010) Countermeasures against fault attacks on software implemented AES. WESS ’10. Association for Computing Machinery, p 7

9. Gemplus SA, Rouchouze, B. (2007, May 11). Method for Protecting an Electronic Component Against Fault Injection Attacks

10. Guillaume-Sage L, Tobich K, Tria A, Dutertre J-M, Maurine P, Zussa L, Dehbaoui A, Tobich K, Dutertre J-M, Maurine P, Guillaume-Sage L, Clediere J, Tria A (2014) Efficiency of a glitch detector against electromagnetic fault injection. Design, Automation and Test in Europe Conference and Exhibition (DATE). IEEE, pp 1–6

11. El-Baze D, Rigaud J-B, Maurine P (2016) A fully-digital EM pulse detector. 2016 Design, Automation Test in Europe Conference Exhibition (DATE). IEEE, pp 439–444

12. Miura N, Najm Z, He W, Bhasin S, Ngo XT, Nagata M, Danger J-L (2016) PLL to the rescue: a novel EM fault countermeasure. 2016 53rd ACM/EDAC/IEEE Design Automation Conference (DAC). ACM, pp 1–6

13. Breier J, Bhasin S, He W (2017) An electromagnetic fault injection sensor using Hogge phase-detector. 2017 18th International Symposium on Quality Electronic Design (ISQED). IEEE, pp 307–312

14. Homma N, Hayashi YI, Miura N, Fujimoto D, Tanaka D, Nagata M, Aoki T (2014) EM attack is non-invasive? Design methodology and validity verification of EM attack sensor. Lecture Notes in Computer Science. Springer

15. Anderson R, Bond M, Clulow J, Skorobogatov S (2006) Cryptographic processors-a survey. Proc IEEE 94:357–369

16. Shahjerdi D, Rajendran J, Garg S, Koushanfar F, Karri R (2015) Shielding and securing integrated circuits with sensors. IEEE/ACM International Conference on Computer-Aided Design, ICCAD. IEEE

17. Briais S, Cioranesco J-M, Danger J-L, Guilley S, Naccache D et al (2012) Random active shield. Fault Diagnosis and Tolerance in Cryptography. IEEE, Leuven, Belgium, p 11. https://doi.org/10.1109/FDTC.2012.11

18. Ngo XT, Danger J-L, Guilley S, Graba T, Mathieu Y, Najm Z, Bhasin S (2017) Cryptographically secure shield for security
IPs protection. IEEE Trans Comput 66(2):354–360. https://doi.org/10.1109/TC.2016.2584041

19. Stan L, Jack K (1963) "Uncanny," X-Men, July, pp. 1–23

**Publisher's Note** Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

Springer Nature or its licensor (e.g. a society or other partner) holds exclusive rights to this article under a publishing agreement with the author(s) or other rightsholder(s); author self-archiving of the accepted manuscript version of this article is solely governed by the terms of such publishing agreement and applicable law.

<figure><img src="image_12.png" /></figure>