# Novel Fault Injection Attack without Artificial Trigger
## 3 Novel Fault Injection Attack System for Relaxing the Fault Injection Attack's Assumption
### Fault Injection Attack System Using I/O Signals as Triggers  
The traditional fault injection attack system requires artificial triggering in order to inject the fault at the attacker's desired timing. Artificial trigger setup is possible when the attacker can revise the internal code of the target device. When we analyze the actual device, the attacker's assumption is not suitable while revising the mounted code of the target device.  
Figure 3 shows a communication process between PC and device. The device conducts the encryption when receiving the plaintext from PC. Then, the device transmits the ciphertext to PC when the encryption is over. The attacker can use the exploiting I/O signals between PC and device as the triggers without the need to set the artificial triggering. If we can use the I/O signals as triggers, the attacker's assumption can be relaxed accordingly so that there is no necessity to revise the code incorporated into the target device to establish artificial triggering.  
Figure 2: Propagation process of fault induced in the input of 9 th round of advanced encryption standard (AES).  
Figure 4 shows the fault injection attack system configuration diagrams. The proposed system includes the oscilloscope, control PC, spider [19], electromagnetic fault injection transient probe [20], and the Arduino UNO board that serves as target device. The proposed system communicates with the control PC and the target device. The oscilloscope is used to register an electromagnetic trace and to accurately detect the location in which a fault has been introduced. Then, the control PC performs an electromagnetic fault injection attack by using Inspector, a side-channel analysis software tool [21]. Inspector can analyze the variety of equipment used for fault injection attacks and save the results of a fault injection attack for further investigation. Moreover, Inspector can be used to check whether fault injection succeeded or failed. An electromagnetic fault injection transient probe consists of the XYZ-table, electromagnetic probe station, and an electromagnetic probe tip [22]. The XYZ-table is used to set attack parameters for a specific location of a target chip. A fault injection attack can be repeatedly performed by moving X, Y, and Z axes. It is performed to find a valid point in the chip to focus fault injection attacks on. Spider is used to control the various communication canals between the target device and the control PC. Moreover, spider can execute various functions, such as restarting through Inspector. Figure 4 represents the configuration diagram for the conventional fault injection attack system, and Figure 4 shows that for the proposed fault injection attack system. As shown in Figure 4, the conventional fault injection attack system requires an additional connection from Arduino UNO board to spider for trigger, whereas the proposed fault injection attack system utilizes the communication line between the control PC and Arduino UNO board. Shaded lines in Figure 4 are for trigger. Since the proposed fault injection attack system makes the trigger line by jumping the communication line, it minimizes the artificial modification of the target board. Considering that the proposed system uses an existing I/O signal as a trigger, it is difficult to identify the location of a specific operation. Therefore, we develop a method to overcome this issue. As shown in Figure 5, we construct an environment using the electromagnetic probe and the oscilloscope to collect an emission electromagnetic trace, then, we perform SPA to identify the time of a target operation. Concerning the rest of the paper, we focus on the AES algorithm even though the attack method is not tied to this algorithm.  
Figure 4: System configuration diagram of **(a)** the conventional fault injection attack system, **(b)** the proposed fault injection attack system.  
Figure 3: Protocol between PC and crypto device.