Driss Aboulkassimi's research while affiliated with CEA Tech and other places

What is this page?
This page lists the scientific contributions of an author, who either does not have a ResearchGate profile, or has not yet added these contributions to their profile.

It was automatically created by ResearchGate to create a record of this author's body of work. We create such pages to advance our goal of creating and maintaining the most comprehensive scientific repository possible. In doing so, we process publicly available (personal) data relating to the author as a member of the scientific community.

If you're a ResearchGate member, you can follow this page to keep up with this author's work.

If you are this author, and you don't want us to display this page anymore, please let us know.

Publications (9)

Combined Fault Injection and Real-Time Side-Channel Analysis for Android Secure-Boot Bypassing
Chapter
  • Jan 2023
The Secure-Boot is a critical security feature in modern devices based on System-on-Chips (SoC). It ensures the authenticity and integrity of the code before its execution, avoiding the SoC to run malicious code. To the best of our knowledge, this paper presents the first bypass of an Android Secure-Boot by using an Electromagnetic Fault Injection...
Figure 3: The ARM v8.4-A exception model [15].
Figure 5: High-level authenticated secure boot process.
Figure 7: Voltage FIA parameters [156].
Figure 8: VoltJockey attack sequence [125].
+8 Figure 9: Using an FIA to introduce an additional positive clock edge [85].
Physical Fault Injection and Side-Channel Attacks on Mobile Devices: A Comprehensive Analysis
Article
Full-text available
  • Sep 2021
Today's mobile devices contain densely packaged system-on-chips (SoCs) with multi-core, high-frequency CPUs and complex pipelines. In parallel, sophisticated SoC-assisted security mechanisms have become commonplace for protecting device data, such as trusted execution environments, full-disk and file-based encryption. Both advancements have dramati...
Figure 3: The ARM v8.4-A exception model [15].
Figure 5: High-level authenticated secure boot process.
Figure 7: Voltage FIA parameters [156].
Figure 8: VoltJockey attack sequence [125].
+7 Figure 9: Using an FIA to introduce an additional positive clock edge [85].
Physical Fault Injection and Side-Channel Attacks on Mobile Devices: A Comprehensive Analysis
Preprint
Full-text available
  • Aug 2021
Today's mobile devices contain densely packaged system-on-chips (SoCs) with multi-core, high-frequency CPUs and complex pipelines. In parallel, sophisticated SoC-assisted security mechanisms have become commonplace for protecting device data, such as trusted execution environments, full-disk and file-based encryption. Both advancements have dramati...

Citations

... Injection probe tips consist of a copper coil with a ferrite core to concentrate the magnetic flux. The resulting pulse and EM field are determined by the number of windings, winding sense, copper wire diameter, and ferrite diameter [19]. Therefore, probe tips need to be carefully selected to achieve desired pulse characteristics for a specific target. ...
Reference: EM-Fault It Yourself: Building a Replicable EMFI Setup for Desktop and Server Hardware
... tab_2 . setObjectName ( _fromUtf8 ( " tab_2 " ) ) 53 self . formLayout_2 = QtGui . ...
Reference: Reverse Engineering of Integrated Circuits: Tools and Techniques
... Their other work characterized the instruction transmission pipeline with the faulted instructions [14]. Ref. [30] reports instruction skip attack on a more complex ARM cortex A9 Microprocessor, and another work is also carried out in the mobile phone processor to obtain higher permissions [31]. One of the thorny problems of an instruction-fetching attack concerns the production of controllable instruction tampering, especially for an EM pulse even with the improved scheme proposed in [28]. ...
Reference: Instruction-Fetching Attack and Practice in Collision Fault Attack on AES
... Localized charges are generated in the DUT by single photon absorption. So far, we do not expect to have any SEU induced by thermal effect since, in PA-MTJ this kind of phenomena are triggered by energy in the order of µJ [14], a value much higher than the range used by the laser facility. The second radiation experiment will be performed at the UCL Cyclotron (Université Catholique de Louvain), of Louvain-la-Neuve. ...
Reference: Heavy Ion Irradiation Effects on Advanced Perpendicular Anisotropy Spin-Transfer Torque Magnetic Tunnel Junction
... Les travaux présentés dans ce chapitre ont été publiés aux conférences internationales "DCIS 2018" [161] et "ISCAS 2019" [162]. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 ...
Reference: Hybridation CMOS/STT-MRAM des circuits intégrés pour la sécurité matérielle de l'internet des Objets
... A SOT-MRAM possui como características: velocidade de escrita entre 3 ns a 10 ns [6], podendo também chegar na faixa dos sub ns [30], velocidade de leitura mais lenta que a de escrita [6] [37] o que deixa a memória grande e com baixa escalabilidade [6,34]. Outro dado importanteé que a SOT-MRAMé muito recente, enquanto a tecnologia de STT-MRAM foi apresentada em 1996 [11] a SOT-MRAM só começou a ser alvo de pesquisas em 2008 [2] e 2009 [1]. ...
Reference: Memórias Não Voláteis: Uma visão geral sobre as principais tecnologias, suas características e níveis de maturidade
... Cette méthode consiste à illuminer le circuit par un faisceau LASER afin d'y induire des effets photoélectriques [82] ou thermiques [83], via respectivement la génération d'un photo-courant dans la structure ou son échauffement. ...
Reference: Hybridation CMOS/STT-MRAM des circuits intégrés pour la sécurité matérielle de l'internet des Objets