Combining Static Analysis and Dynamic Symbolic Execution in a Toolchain to detect Fault Injection Vulnerabilities

17 pages•Published: October 3, 2022

Guilhem Lacombe, David Féliot, Etienne Boespflug and Marie-Laure Potet

Abstract

Certification through auditing allows to ensure that critical embedded systems are secure. This entails reviewing their cryptographic components and checking for dangerous execution paths. This latter task requires the use of specialized tools which allow to explore and replay executions but are also difficult to use effectively within the context of the audit, where time and knowledge of the code are limited. Fault analysis is especially tricky as the attacker may actively influence execution, rendering some common methods unusable and increasing the number of possible execution paths exponentially. In this work, we present a new method which mitigates these issues by reducing the number of fault injection points considered to only the most relevant ones relatively to some security properties. We use fast and robust static analysis to detect injection points and assert their impactfulness. A more precise dynamic/symbolic method is then employed to validate attack paths. This way the insight required to find attacks is reduced and dynamic methods can better scale to realistically sized programs. Our method is implemented into a toolchain based on Frama-C and KLEE and validated on WooKey, a case-study proposed by the National Cybersecurity Agency of France.

Keyphrases: bootloader use case, fault injection robustness, source code static analysis, symbolic execution

In: Ulrich Kühne and Fan Zhang (editors). Proceedings of 10th International Workshop on Security Proofs for Embedded Systems, vol 87, pages 1-17.

Links:	https://easychair.org/publications/paper/Z6bp
	https://doi.org/10.29007/jp9w

BibTeX entry

@inproceedings{PROOFS2021:Combining_Static_Analysis_Dynamic,
  author    = {Guilhem Lacombe and David Féliot and Etienne Boespflug and Marie-Laure Potet},
  title     = {Combining Static Analysis and Dynamic Symbolic Execution in a Toolchain to detect Fault Injection Vulnerabilities},
  booktitle = {Proceedings of 10th International Workshop on Security Proofs for Embedded Systems},
  editor    = {Ulrich Kühne and Fan Zhang},
  series    = {EPiC Series in Computing},
  volume    = {87},
  publisher = {EasyChair},
  bibsource = {EasyChair, https://easychair.org},
  issn      = {2398-7340},
  url       = {/publications/paper/Z6bp},
  doi       = {10.29007/jp9w},
  pages     = {1-17},
  year      = {2022}}

Download PDF Open PDF in browser