6 Security Countermeasures

An important aspect of implementing a cybersecurity strategy for embedded systems is identifying weaknesses in the system, enumerating potential attack types and scenarios, and implementing cybersecurity controls to mitigate those attacks. Embedded control systems tend to be more accessible to attack techniques that require local or physical access to the device. These include connections to the debug port, fault injection attacks such as power or clock glitching, and other side-channel attacks. A sound embedded security implementation identifies these various attack scenarios and implements countermeasures to mitigate them.

Fault injection attacks in principle attempt to redirect CPU execution by introducing a temporary anomaly in the device’s power supply voltage or system clock signal. For example, each device data sheet includes specified operating voltage ranges for power supply rails such as core, I/O, and analog, as well as operating temperature ranges. This means that the device is designed to operate correctly and meet all timing requirements within these voltage and temperature ranges; operating the device outside the specified bounds could result in unspecified behavior. In practice, violating these specifications typically results in timing-related faults: undervoltage conditions cause setup time violations, and overvoltage conditions lead to hold time violations. Alternatively, an accessible input clock signal, such as a crystal oscillator input pin, could be used to directly inject timing faults at key points in time. A well-timed fault can result in skipped instructions or redirected execution at critical security decision points in firmware, leading to unauthorized access or exposure of embedded secrets. Tools for performing the required timing analysis to execute successful fault injection attacks are increasingly easy to obtain. Countermeasures against these types of attacks can include internal voltage and clock frequency monitoring circuits.

For protection against fault injection attacks, the ability to instantaneously detect single- or double-bit faults is a valuable tool. Error Correction Code logic (ECC) is an example of such a protection mechanism, providing the ability to automatically correct single-bit faults and detect double-bit faults in memory or on a bus. The mechanism operates using a pre-computed code that is typically written into memory alongside each data word. ECC is commonly used within functional safety contexts, but is also valuable as a security countermeasure, enabling the system to either reject injected faults, or respond by halting execution and sending out an error signal. In TI’s AM26x microcontrollers, all ECC protection is available for all on-chip memories and caches, and also for various peripheral subsystems and interconnects. F29x microcontrollers feature ECC protection built directly into the C29 CPU and device interconnect, providing robust end-to-end protection against code and data faults across all memories and peripherals during application runtime.