Automated fault injection testing
Inventors
Fletcher, Austin • SU, Daniel • Boccuzzi, Bradley
Assignees
Interested in licensing this patent?
MTEC can help explore whether this patent might be available for licensing for your application.
Publication Number
US-11567855-B1
Publication Date
2023-01-31
Expiration Date
Abstract
An automated fault injection testing and analysis approach drives fault injection into a processor driven instruction sequence to quantify and define susceptibility to external fault injections for manipulating instruction execution and control flow of a set of computer instructions. A fault injection such as a voltage or electromagnetic pulse directed at predetermined locations on a processor (Central Processing Unit, or CPU) alters a result of a processor instruction to change values or execution paths. One or more quantified injections define an injection chain that causes a predictable or repeatable deviant result from an expected execution path through the code executed by the processor. Based on accumulation of fault injections and results, a repeatable injection chain and probability identifies an external action taken on a processing device to cause unexpected results that differ from an expected execution of a program or set of computer instructions.
Core Innovation
The invention provides an automated fault injection testing approach for forcing control flow of an instruction sequence executed by a processor. It identifies a memory location that includes a candidate instruction and estimates a duration for execution to proceed to the identified location. It then performs a sample injection directed to modifying a value of the memory location at an execution time based on the estimated duration, where a result of the candidate instruction determines an execution path taken as a result of the sample injection.
The sample injection is defined by a location on a planar area of the processor and includes power, delay, and repetition of an electromagnetic pulse directed at the location. The approach evaluates a result of the sample injection by capturing outcomes such as next execution addresses and/or success versus failure path indicators. It determines whether the injection modifies execution such that execution proceeds along alternate control-flow paths caused by the modified result of the candidate instruction.
The invention further quantifies injection susceptibility by building an injection chain that includes locations, timing, intensity, pulse parameters, polarity, and repetition, and by evaluating success versus failure based on captured next-execution addresses/path outcomes. It iteratively selects injection parameters using a machine learning model to obtain a repeatable effect, and it associates probability with a sample injection resulting in taking a branch leading to a result injection path caused by the modified result of the candidate instruction.
Claims Coverage
The provided independent claims cover methods for forcing control flow of an instruction sequence using timed sample injections defined by processor planar locations and electromagnetic pulse parameters, together with evaluation of execution-path outcomes and, in some embodiments, iterative and injected-instruction-sequence control.
Forcing control flow by timing a sample injection to a candidate instruction memory location
A method comprising identifying a memory location in an instruction sequence under analysis; estimating a duration for execution to proceed to the identified memory location; performing a sample injection directed to modifying a value of the memory location at an execution time based on the estimated duration, the memory location including a candidate instruction, and the result of the candidate instruction determines an execution path taken as a result of the sample injection; and evaluating a result of the sample injection.
Forcing control flow using iterative sample injections with probability-gathering and accumulation
A method comprising identifying a memory location in an instruction sequence under analysis; estimating a duration for execution to proceed to the identified memory location by identifying the instructions included in the execution path and accumulating a time required for aggregate processing of each of the instructions on the execution path prior to the memory location; performing a sample injection directed to modifying a value of the memory location at an execution time based on the estimated duration, the memory location including a candidate instruction, and a result of the candidate instruction determines an execution path taken as a result of the sample injection; evaluating the result of the sample injection; iteratively repeating the sample injection for dynamically analyzing an injection likely to modify the candidate instruction; gathering, based on a probability of a sample injection resulting in taking a branch leading to a result injection path caused by the modified result of the candidate instruction; and accumulating the sample injections leading to the modified result during the iterative repetitions.
Forcing control flow using a generated injection instruction sequence stored in a non-executed memory region with breakpoint-directed execution
A method comprising identifying a memory location in an instruction sequence under analysis; estimating a duration for execution to proceed to the identified memory location; performing a sample injection directed to modifying a value of the memory location at an execution time based on the estimated duration, the memory location including a candidate instruction, and the result of the candidate instruction determines an execution path taken as a result of the sample injection; identifying an instruction in the instruction sequence that precedes the candidate instruction; generating an injection instruction sequence for generating the sample injection; identifying a non-executed memory region in a program memory space allocated to the instruction sequence, the non-executed memory region having sufficient space for storing the injection instruction sequence; storing the injection instruction sequence in the identified non-executed memory region; and directing a breakpoint at the identified preceding instruction for executing the injected instruction sequence upon program execution attaining the identified preceding instruction; and evaluating a result of the sample injection.
Forcing control flow via a computer program implementing timed electromagnetic fault injection
A computer program embodying program code on a non-transitory storage media that, when executed by a processor, performs steps for implementing a method of forcing a control flow of an instruction sequence, the method comprising: identifying a candidate instruction in an instruction sequence under analysis; estimating a duration for execution to proceed to the candidate instruction; performing a sample injection directed to modifying a result of the candidate instruction at an execution time based on the estimated duration, the memory location including a candidate instruction, and the result of the candidate instruction determines an execution path taken as a result of the sample injection; and evaluating a path result based on an execution path taken as a result of the sample injection, the sample injection defined by a location on a planar area of a processor executing the candidate instruction, the injection including a power, delay and repetition of an electromagnetic pulse directed at the location.
Across the independent claims, the core claim coverage centers on identifying a target memory location or candidate instruction, estimating execution timing to reach it, and performing an electromagnetic-pulse-defined sample injection at a processor planar location so that the candidate instruction’s modified result determines an execution path. The claims also cover evaluating path outcomes and, in further embodiments, iteratively repeating injections with probability-based gathering and/or using a generated injection instruction sequence stored in a non-executed memory region and executed via a breakpoint at a preceding instruction.
Stated Advantages
Documented Applications
No documented applications found
Interested in licensing this patent?