Overview
The Langer-EMV ICI-DP HH series double pulse magnetic field attack generator is designed to inject electromagnetic pulses with high temporal and spatial resolution into safety critical circuits (electromagnetic fault injection - EMFI). This set can be used to generate single pulses as well as a double pulse sequence with a pulse following time of minimum 25 ns. The set includes the high voltage source BPS 204 as well as the probe ICI-DP HH150-15.
Probe heads are are avaiable in dimensions:
- Ø 150 µm
- Ø 250 µm
- Ø 500 µm
- Ø 1000 µm
Via the sync inputs of the probe or the BPS, the pulses can be synchronized to an external function sequence.
Parameters such as pulse voltage and polarity can be set via software.
Standard Accessory Kit:
- 1xICI-DP HH double-pulse magnetic field source
- 1xBPS 204, Burst Power Station
- 1xBPS 204 client, software BPS 204 client
- 1xHV FI-FI mini 1 m, high-voltage cable Fischer-Fischer
- 1xSK FI-FI mini 7P 1 m, control cable Fischer-Fischer
- 4xSMA-SSMB 1 m, measuring cable SMA-SSMB
- 1xNT FRI EU 24V, plug-in power supply
- 1xUSB-AB, USB cable type AB
- 1xICI-DP case, system case
- 1xICI-DP m, User Manual ICI-DP Set
- 1xBPS 204 m, User Manual BPS 204
- 1xICI-DP qg, case insert
The methodology involves:
- Pulse generation: A high-voltage generator is used to create one or more fast, transient current pulses. Equipment from companies like Langer EMV is specifically designed to create double-pulse sequences for this purpose, with timing delays down to a few nanoseconds.
- Pulse injection: An EM probe, or coil, is used to inject the magnetic pulses with high spatial and temporal resolution onto a target IC. The attacker precisely positions the probe over the device, often using automated stages, to affect a specific part of the circuit.
- Targeting complex operations: The first pulse can be used to induce a temporary and specific fault, such as corrupting data in a register or forcing a memory bus to a particular state. The second pulse, timed shortly after, can then be used to exploit that initial, transient state to achieve a full compromise, such as skipping a cryptographic function.
