MAFIA: Protecting the microarchitecture of embedded systems against fault injection attacks

International audienceFault injection attacks represent an effective threatto embedded systems. Recently, Laurent et al. have reported thatfault injection attacks can leverage faults inside the microarchi-tecture. However, state-of-the-art counter-measures, hardware-only or with hardware support, do not consider the integrityof microarchitecture control signals that are the target of thesefaults.We present MAFIA, a microarchitecture protection againstfault injection attacks. MAFIA ensures integrity of pipelinecontrol signals through a signature-based mechanism, and en-sures fine-grained control-flow integrity with a complete indirectbranch support and code authenticity. We analyse the securityproperties of two different implementations with different secu-rity/overhead trade-offs: one with a CBC-MAC/Prince signaturefunction, and another one with a CRC32. We present ourimplementation of MAFIA in a RISC-V processor, supportedby a dedicated compiler toolchain based on LLVM/Clang. Wereport a hardware area overhead of 23.8 % and 6.5 % for theCBC-MAC/Prince and CRC32 respectively. The average code sizeand execution time overheads are 29.4 % and 18.4 % respectivelyfor the CRC32 implementation and are 50 % and 39 % for theCBC-MAC/Prince