{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,30]],"date-time":"2026-09-30T13:51:25Z","timestamp":1790776285322,"version":"4.1.0"},"reference-count":33,"publisher":"MDPI AG","issue":"2","license":[{"start":{"date-parts":[[2021,6,7]],"date-time":"2021-06-07T00:00:00Z","timestamp":1623024000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"National Science Foundation","award":["1503742"],"award-info":[{"award-number":["1503742"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Cryptography"],"abstract":"<jats:p>Fault injection simulation on embedded software is typically captured using a high-level fault model that expresses fault behavior in terms of programmer-observable quantities. These fault models hide the true sensitivity of the underlying processor hardware to fault injection, and they are unable to correctly capture fault effects in the programmer-invisible part of the processor microarchitecture. We present SimpliFI, a simulation methodology to test fault attacks on embedded software using a hardware simulation of the processor running the software. We explain the purpose and advantage of SimpliFI, describe automation of the simulation framework, and apply SimpliFI on a BRISC-V embedded processor running an AES application.<\/jats:p>","DOI":"10.3390\/cryptography5020015","type":"journal-article","created":{"date-parts":[[2021,6,7]],"date-time":"2021-06-07T22:23:00Z","timestamp":1623104580000},"page":"15","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":12,"title":["SimpliFI: Hardware Simulation of Embedded Software Fault Attacks"],"prefix":"10.3390","volume":"5","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-4219-0493","authenticated-orcid":false,"given":"Jacob","family":"Grycel","sequence":"first","affiliation":[{"name":"Department of Electrical and Computer Engineering, Worcester Polytechnic Institute, Worcester, MA 01609, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4586-5476","authenticated-orcid":false,"given":"Patrick","family":"Schaumont","sequence":"additional","affiliation":[{"name":"Department of Electrical and Computer Engineering, Worcester Polytechnic Institute, Worcester, MA 01609, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2021,6,7]]},"reference":[{"key":"ref_1","unstructured":"Riscure (2020). Riscure FiSim, GitHub. Available online: https:\/\/github.com\/Riscure\/FiSim."},{"key":"ref_2","first-page":"3","article-title":"FISSC: A Fault Injection and Simulation Secure Collection","volume":"Volume 9922","author":"Skavhaug","year":"2016","journal-title":"Proceedings of the Computer Safety, Reliability, and Security\u201435th International Conference, SAFECOMP 2016"},{"key":"ref_3","unstructured":"Breveglieri, L., Guilley, S., Koren, I., Naccache, D., and Takahashi, J. (2011, January 29). An In-depth and Black-box Characterization of the Effects of Clock Glitches on 8-bit MCUs. Proceedings of the 2011 Workshop on Fault Diagnosis and Tolerance in Cryptography, FDTC 2011, Nara, Japan."},{"key":"ref_4","unstructured":"Breveglieri, L., Guilley, S., Koren, I., Naccache, D., and Takahashi, J. (2011, January 29). Practical Optical Fault Injection on Secure Microcontrollers. Proceedings of the 2011 Workshop on Fault Diagnosis and Tolerance in Cryptography, FDTC 2011, Nara, Japan."},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Bandara, S., Ehret, A., Kava, D., and Kinsy, M. (2019, January 24\u201326). BRISC-V: An Open-Source Architecture Design Space Exploration Toolbox. Proceedings of the 27th ACM\/SIGDA International Symposium on Field-Programmable Gate Arrays (FPGA), Monterey, CA, USA.","DOI":"10.1145\/3289602.3293991"},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Agrawal, R., Bandara, S., Isakov, M., Mark, M., and Kinsy, M. (2019, January 22). The BRISC-V Platform: A Practical Teaching Approach for Computer Architecture. Proceedings of the Workshop on Computer Architecture Education (WCAE), Phoenix, AZ, USA.","DOI":"10.1145\/3338698.3338891"},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"370","DOI":"10.1109\/JPROC.2005.862424","article-title":"The Sorcerer\u2019s Apprentice Guide to Fault Attacks","volume":"94","author":"Choukri","year":"2006","journal-title":"Proc. IEEE"},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"3056","DOI":"10.1109\/JPROC.2012.2188769","article-title":"Fault Injection Attacks on Cryptographic Devices: Theory, Practice, and Countermeasures","volume":"100","author":"Barenghi","year":"2012","journal-title":"Proc. IEEE"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"111","DOI":"10.1007\/s41635-018-0038-1","article-title":"Fault Attacks on Secure Embedded Software: Threats, Design, and Evaluation","volume":"2","author":"Yuce","year":"2018","journal-title":"J. Hardw. Syst. Secur."},{"key":"ref_10","unstructured":"Fischer, W., and Schmidt, J. (2013, January 20). Electromagnetic Fault Injection: Towards a Fault Model on a 32-bit Microcontroller. Proceedings of the 2013 Workshop on Fault Diagnosis and Tolerance in Cryptography, FDTC 2013, Santa Barbara, CA, USA."},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Proy, J., Heydemann, K., Berzati, A., Maj\u00e9ric, F., and Cohen, A. (2019, January 26\u201329). A First ISA-Level Characterization of EM Pulse Effects on Superscalar Microarchitectures: A Secure Software Perspective. Proceedings of the 14th International Conference on Availability, Reliability and Security, Canterbury, UK.","DOI":"10.1145\/3339252.3339253"},{"key":"ref_12","unstructured":"Trouchkine, T. (2016). SoC Physical Security Evaluation. [Ph.D. Thesis, Universit\u00e9 Grenobles Alpes]."},{"key":"ref_13","first-page":"3","article-title":"The State of Fault Injection Vulnerability Detection","volume":"Volume 11181","author":"Atig","year":"2018","journal-title":"Proceedings of the Verification and Evaluation of Computer and Communication Systems\u201412th International Conference, VECoS 2018"},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"J\u00fcrjens, J., Piessens, F., and Bielova, N. (2014). Idea: Embedded Fault Injection Simulator on Smartcard, Springer International Publishing. Engineering Secure Software and Systems.","DOI":"10.1007\/978-3-319-04897-0"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Sklavos, N., Chaves, R., Di Natale, G., and Regazzoni, F. (2017). Fault Attacks, Injection Techniques and Tools for Simulation. Hardware Security and Trust: Design and Deployment of Integrated Circuits in a Threatened Environment, Springer International Publishing.","DOI":"10.1007\/978-3-319-44318-8"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Yuce, B., Ghalaty, N.F., and Schaumont, P. (2015, January 5\u20137). TVVF: Estimating the Vulnerability of Hardware Cryptosystems against Timing Violation Attacks. Proceedings of the 2015 IEEE International Symposium on Hardware Oriented Security and Trust (HOST), Washington, DC, USA.","DOI":"10.1109\/HST.2015.7140240"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Arribas, V., Wegener, F., Moradi, A., and Nikova, S. (2020, January 7\u201311). Cryptographic Fault Diagnosis using VerFI. Proceedings of the 2020 IEEE International Symposium on Hardware Oriented Security and Trust (HOST), San Jose, CA, USA.","DOI":"10.1109\/HOST45689.2020.9300264"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3063311","article-title":"Analyzing the Fault Injection Sensitivity of Secure Embedded Software","volume":"16","author":"Yuce","year":"2017","journal-title":"ACM Trans. Embed. Comput. Syst."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"H\u00f6ller, A., Krieg, A., Rauter, T., Iber, J., and Kreiner, C. (2015, January 26\u201328). QEMU-Based Fault Injection for a System-Level Analysis of Software Countermeasures Against Fault Attacks. Proceedings of the 2015 Euromicro Conference on Digital System Design, DSD 2015, Madeira, Portugal.","DOI":"10.1109\/DSD.2015.79"},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"43","DOI":"10.1007\/s10836-015-5555-z","article-title":"Simulation-based Fault Injection with QEMU for Speeding-up Dependability Analysis of Embedded Software","volume":"32","author":"Ferraretto","year":"2016","journal-title":"J. Electron. Test."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Breier, J. (September, January 31). On Analyzing Program Behavior under Fault Injection Attacks. Proceedings of the 11th International Conference on Availability, Reliability and Security, ARES 2016, Salzburg, Austria.","DOI":"10.1109\/ARES.2016.4"},{"key":"ref_22","unstructured":"Xilinx (2019). 7 Series FPGAs Memory Resources, Xilinx Inc."},{"key":"ref_23","unstructured":"Mentor Graphics (2012). ModelSim User\u2019s Manual, Mentor Graphics Corporation."},{"key":"ref_24","unstructured":"Xilinx (2020). Vivado Design Suite UserGuide: Logic Simulation, Xilinx Inc."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"734","DOI":"10.1109\/82.199899","article-title":"Metastability of CMOS master\/slave flip-flops","volume":"39","author":"Gabara","year":"1992","journal-title":"IEEE Trans. Circuits Syst. II Analog. Digit. Signal Process."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"146","DOI":"10.1109\/4.16314","article-title":"Metastability Behavior of CMOS ASIC flip-flops in Theory and Test","volume":"24","author":"Horstmann","year":"1989","journal-title":"IEEE J. Solid-State Circuits"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"4","DOI":"10.1109\/MDT.1987.295189","article-title":"Metastable Behavior in Digital Systems","volume":"4","author":"Kleeman","year":"1987","journal-title":"IEEE Des. Test Comput."},{"key":"ref_28","unstructured":"Chard, G.F., Koyuncu, O., Koh, T.P.R., and Dondershine, S. (2005). Modeling Metastability in Circuit Design. (7139988B2), U.S. Patent."},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"680","DOI":"10.1109\/TCAD.2020.3003287","article-title":"Modeling and Simulating Electromagnetic Fault Injection","volume":"40","author":"Dumont","year":"2021","journal-title":"IEEE Trans. Comput. Aided Des. Integr. Circuits Syst."},{"key":"ref_30","unstructured":"Wright, R.N. (2003). Fault Based Cryptanalysis of the Advanced Encryption Standard (AES). Financial Cryptography, Springer."},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Goubin, L., and Matsui, M. (2006, January 10\u201313). A Generalized Method of Differential Fault Attack Against AES Cryptosystem. Proceedings of the Cryptographic Hardware and Embedded Systems\u2014CHES 2006, Yokohama, Japan.","DOI":"10.1007\/11894063"},{"key":"ref_32","unstructured":"NIST (2021). Lightweight Cryptography Benchmarking, GitHub. Available online: https:\/\/github.com\/usnistgov\/Lightweight-Cryptography-Benchmarking."},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Mangard, S., and Standaert, F.X. (2020, January 17\u201320). Fault Sensitivity Analysis. Proceedings of the Cryptographic Hardware and Embedded Systems, CHES 2010, Santa Barbara, CA, USA.","DOI":"10.1007\/978-3-642-15031-9"}],"container-title":["Cryptography"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2410-387X\/5\/2\/15\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T06:11:50Z","timestamp":1760163110000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2410-387X\/5\/2\/15"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,6,7]]},"references-count":33,"journal-issue":{"issue":"2","published-online":{"date-parts":[[2021,6]]}},"alternative-id":["cryptography5020015"],"URL":"https:\/\/doi.org\/10.3390\/cryptography5020015","relation":{},"ISSN":["2410-387X"],"issn-type":[{"value":"2410-387X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,6,7]]}}}