Cybersecurity formal analysis of fault-injection attacks in hardware/software embedded systems H/F

CEA; Saclay; Sur place; EUR 35 000 - 50 000; Plein temps

Résumé du poste

A French research commission seeks a motivated Post-doc researcher specializing in cybersecurity and fault-injection attacks. Candidates should possess a PhD in computer science or related fields, with expertise in formal verification and microarchitecture security. The position involves defining security contracts to analyze vulnerabilities in embedded systems as part of the TwinSec project, coordinated by leading French laboratories. This role is open to all candidates, including persons with disabilities.

Qualifications

• Experience with RISC-V processors, ISA-level / binary analysis tools, or domain-specific languages is a plus.
• Strong programming skills and analytical thinking required.

Responsabilités

• Define a semantics for the use of contracts in the context of fault injection attacks.
• Explore how security contracts can enhance microarchitectural-level analyses.
• Investigate the use of contracts to integrate microarchitectural descriptions into ISA-level analysis tools.

Connaissances

Expertise in fault-injection attacks

Formal verification

Microarchitecture security

Strong programming skills

Analytical thinking

Formation

PhD in computer science, embedded systems, or related fields

Outils

RISC-V processors

ISA-level analysis tools

Domain-specific languages

Description du poste

Overview

Cybersecurity formal analysis of fault-injection attacks in hardware/software embedded systems H/F

Context

The national TwinSec research project aims to establish an end-to-end methodology to identify and cancel, at the design stage, microarchitecture-specific vulnerabilities. The TwinSec project, which frames this Post-doc research, brings together several French laboratories specializing in hardware and software security to model and analyze fault-injections' effects at physical, hardware (HW), Instruction Set Architecture (ISA) and software (SW) levels. It focuses on physical attacks, mainly on fault injection using lasers, and proposes a more realistic attacker model for a multi-level fault analysis. Existing modeling tools are not yet capable of efficiently predicting a embedded systems\' resistance to such attacks due to generic fault models. To ensure scalable formal analyses within this end-to-end methodology, appropriate ways to exchange information between layers must be defined.

Research Context and Challenge.

Fault-injection attacks exploit hardware perturbations to move a processor into unexpected states or execution paths, potentially exposing secrets or escalating privileges. Recent research has highlighted the need to consider the consequences of fault injection in the processor micro-architecture. In this area, we have developed pre-silicon methodologies and tools that have shown to be successful to find microarchitectural vulnerabilities and/or formally prove the robustness, for a given fault model, of various RISC-V based processors. We have also developed binary-level program analysis methods (BINSEC/ASE) able to efficiently take into account some predefined ISA-level fault injection models. Yet, a major and common challenge of all these approaches lies in the state space generated by the modeling of processor’s behavior executing a sequence of instructions and under a fault model.

Objective

This position focuses on defining and implementing security contracts for fault-injection attacker models. The proposed security contracts should support a multi-level approach, enabling the design and analysis of hybrid countermeasures, while also bridging fault models derived from experimental characterizations to the software level. They will also be used to revisit our k-fault-resistant partitioning methodology to analysis multi-fault models within complex systems, such as applications processors, and to help our binary-level code analyzers to handle more generic classes of fault models.

Within the TwinSec research project, your main missions will be to:

• Define a semantics for the use of contracts in the context of fault injection attacks. Potential implementations may involve a domain-specific language or annotations to describe, at the ISA-level, the effects of faults stemming from the microarchitectural level. The model must account for both spatial aspects (defining RTL/netlist-level signals to be targeted) and temporal aspects (identifying injection time intervals).
• Explore how such security contracts can enhance microarchitectural-level analyses, in particular by integrating into fault models information from experimental characterizations of laser injections. In particular, as TwinSec proposes a more realistic attacker model to identify microarchitecture-specific vulnerabilities, microarchitectural analyses could leverage for instance post-layout information.
• Investigate the use of security contracts to integrate microarchitectural descriptions into ISA-level analysis tools like Binsec. The expected outcome is the validation of a multi-level semantics for contracts adapted to the context of fault injection attacks, ultimately enabling the implementation of an end-to-end analysis tool.

The major breakthrough introduced by security contracts will be the ability to provide formal composable security properties, thus enabling the exploration of binary-level software analyses with RTL or post-synthesis level analyses of secure hardware circuits.

We are seeking a motivated researcher with:

• A PhD in computer science, embedded systems, or related fields.
• Expertise in fault-injection attacks, formal verification, or microarchitecture security.
• Strong programming skills and analytical thinking. Experience with RISC-V processors, ISA-level / binary analysis tools, or domain-specific languages is a plus.

In accordance with the commitments made by the CEA in favor of the integration of people with disabilities, this job is open to everyone.

The TwinSec project is also recruiting a PhD candidate to work on the topic of security contracts for fault-injection attacker models. The Post-doc researcher will participate in the co-supervision of this PhD project and contribute to the development of the methodologies and tools designed by the PhD student.

Site

Saclay

15/09/2025

Référence

2025-36528

The French Alternative Energies and Atomic Energy Commission (CEA) is a leader in research, development, and innovation across key areas such as defense and security, energy, industry, and fundamental sciences. Within CEA, the List institute focuses on technological innovation in digital systems. The proposed position involves two different teams: one team specializes in developing pre-silicon methodologies and tools to analyze the security of embedded systems against fault-injection attacks, another one developing automated program analysis, here for binary-level security.