Intel Introduces Protection Against Physical Fault Injection Attacks

Intel on Thursday announced Tunable Replica Circuit (TRC), a new fault injection protection in the 12th generation Intel Core processors, meant to identify non-invasive physical glitch attacks and electromagnetic fault injections.

Designed to complement existing software mitigations, TRC relies on hardware-based sensors to detect dynamic variations in circuits and can be fine-tuned to detect only timing violations that are caused by an attack.

“By changing the monitoring configuration and building the infrastructure to leverage the sensitivity of the TRC to fault injection attacks, the circuit was tuned for security applications,” Carlos Tokunaga, principal engineer in Intel Labs, said.

TRC is meant to deliver protections against certain types of physical attacks and can be calibrated for specific digital circuits, to detect timing failures caused by multiple environmental conditions, including clock, electromagnetic, temperature, or voltage glitches.

According to Daniel Nemiroff, senior principal engineer at Intel, fault injection attacks allow attackers to execute malicious instructions and potentially leak data through clock pin, electromagnetic, and voltage glitches.

“Software protections have hardened with virtualization, stack canaries and code authentication before execution. This has driven malicious actors to turn their attention to physically attacking computing platforms,” Nemiroff said.

TRC consists of a launching flip-flop (FF), a tunable delay chain, and a capture FF. The delay chain, Intel explains, can be calibrated per device, to ensure that TRC correctly determines the right timing of each cycle.

The tech giant also explains that calibration is the key to eliminating false-positives and that it has created a feedback-based calibration flow to help eliminate both false-positives and false-negatives.

Intel says it has applied the new protection to the Platform Controller Hub (PCH), a chipset that is isolated from the CPU and which is meant to improve the security of a system’s root of trust.

Because it is a digital device, TRC can be easily ported from one process node to another and uses a smaller die area compared to building both an analog clock monitor and analog voltage level detector, Intel explains in a technical paper.

Related: Intel Patches Severe Vulnerabilities in Firmware, Management Software

Related: ÆPIC Leak: Architectural Bug in Intel CPUs Exposes Protected Data

Related: Retbleed: New Speculative Execution Attack Targets Intel, AMD Processors