Finite state machines (FSMs) regulate sequential circuits, including access to sensitive information and privileged CPU states. Courtesy of contemporary research on laser attacks, laser-based fault injection (LFI) is becoming even more precise where an adversary can thwart chip security by altering individual flip-flop (FF) values. Different laser models, e.g., bit flip, bit set, and bit reset, have been developed to appreciate LFI on practical targets. As traditional approaches may incorporate substantial overhead, state-based SPARSE and transition-based TAMED countermeasures were proposed in our prior work to improve FSM resiliency efficiently. TAMED overcame SPARSE's limitation of being too conservative, and generating multiple LFI resilient encodings for contemporary LFI models on demand. SPARSE, however, incorporated design layout information into its vulnerability estimation which makes its vulnerability estimation metric more accurate. In this paper, we extend TAMED by proposing a transition-based encoding CAD framework (TRANSPOSE), that incorporates spatial transitional vulnerability metrics to quantify design susceptibility of FSMs based on both the bit flip model and the set-reset models. TRANSPOSE also incorporates floorplan optimization into its framework to accommodate secure spatial inter-distance of FF-sensitive regions. All TRANSPOSE approaches are demonstrated on 5 multifarious benchmarks and outperform existing FSM encoding schemes/frameworks in terms of security and overhead.

翻译：有限状态机（FSM）调控着包括敏感信息访问与特权CPU状态在内的时序电路。受益于激光攻击的当代研究，基于激光的故障注入（LFI）正变得愈发精准，攻击者可通过改变单个触发器（FF）的取值来破坏芯片安全。为在实际目标上实现LFI，目前已发展出多种激光模型，例如位翻转、位置位与位复位。由于传统方法可能引入显著开销，我们先前的工作提出了基于状态的SPARSE与基于状态转移的TAMED防护措施，以高效提升FSM的容错能力。TAMED克服了SPARSE过于保守的局限，并能够按需为当代LFI模型生成多种LFI容错编码。然而，SPARSE在其脆弱性评估中纳入了设计版图信息，使其脆弱性评估指标更为精确。本文通过提出一种基于状态转移的编码CAD框架（TRANSPOSE）来扩展TAMED，该框架结合了空间转移脆弱性度量，以基于位翻转模型及置位-复位模型量化FSM的设计脆弱性。TRANSPOSE还将布局规划优化纳入其框架，以适应FF敏感区域的安全空间间距。所有TRANSPOSE方法均在5个多样化基准测试中得到验证，并在安全性与开销方面优于现有的FSM编码方案/框架。