CAFFI: A Cybersecurity Assessment Framework for Fault Injection Threats in Smart IoT Devices

Abstract

The rapid increase in employing smart Internet of Things <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$(\text{IoT})$</tex> systems in different domains, including critical national infrastructure and vital services has raised the need for robust security measures, especially against physical fault injection attacks. These attacks, involving techniques like voltage glitches and electromagnetic interference, can disrupt device operations, leading to unauthorized access, data extraction, or the disabling of security features, introducing a significant threat to the integrity and reliability of critical IoT-based applications. This paper proposes a novel framework for assessing the security of <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\text{IoT}$</tex> devices against fault injection attacks. The framework employs multiple techniques, specifically voltage and electromagnetic attacks, to evaluate system resilience by targeting different fault models such as instruction skipping and bypassing security features. It is designed to be extensible for future fault models and microcontroller targets in the future. The framework is validated on the NXP LPC1343 microcontroller, demonstrating its effectiveness in bypassing debug interface protection. This framework enables systematic evaluation of <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\text{IoT}$</tex> device robustness, helping identify vulnerabilities and develop more effective countermeasures to enhance the security of embedded systems and <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\text{IoT}$</tex> devices.