As an intern at the CEA, you will have the opportunity to work within a world-renowned research environment. Our teams consist of passionate and dedicated experts, providing an ideal setting for learning and collaboration. You will have access to state-of-the-art equipment and top-tier research resources to carry out your assignments. The work conducted may potentially lead to a scientific publication.

Context :

Laser fault injection (LFI) attacks pose a significant threat to security-critical embedded systems, enabling adversaries to manipulate processor behavior by inducing transient or permanent faults in integrated circuits. While post-silicon evaluations on fabricated devices provide concrete evidence of vulnerabilities, they are often costly, time-consuming, and difficult to interpret precisely. Conversely, pre-silicon security verification (e.g. using tools like μArchiFI [https://github.com/CEA-LIST/uArchiFI]) allows for systematic exploration of fault scenarios at the RTL or netlist levels but relies on abstract fault models that may not accurately reflect real-world physical attacks. This disconnect creates a methodological gap: experimental campaigns reveal actual fault effects [2], but their implications for design-time security assurance (e.g. wether a fault injection leads to a concrete vulnerability exploitation) needs further exploration [3].

The emergence of open-source hardware architectures, such as RISC-V-based processors, offers new opportunities to bridge this gap. When RTL descriptions, synthesized netlists, and physical layout information are available, it becomes possible to correlate experimental observations with microarchitectural behavior. Existing fabricated test chips, already available in the lab in advanced technologies [4] (e.g., 22nm FD-SOI or 28nm CMOS), further enable the validation of fault models under realistic conditions. However, existing approaches lack a systematic methodology to translate experimental data into physically grounded fault models that can be effectively used in pre-silicon verification.

What do we expect from you?

The long-term objective is to develop a bottom-up methodology for deriving and validating pre-silicon fault models from laser fault injection campaigns. This internship will focus on bridging the gap between RTL-level fault analysis, enriched with layout-level information, and results of fault injection campaigns. This work may lead to the design of new fault models derived from experimental observations and physical design information. By integrating these refined models into tools like μArchiFI, the internship will contribute to improving the accuracy and traceability of pre-silicon security assessments, ultimately supporting the development of more robust processors.

#Cea-List

We are seeking a highly motivated student in the final year of a master’s program (M2) or engineering school, with a strong background in computer engineering, digital design, or hardware security. The ideal candidate should have:

• Experience with VHDL/Verilog, RTL design, and hardware description languages.
• Familiarity with microprocessor architectures (e.g., RISC-V) and security evaluation methodologies is a plus.
• Knowledge of fault injection, formal verification, or security analysis.Strong analytical and problem-solving skills, with the ability to work independently and in a team.
• Excellent written and oral communication skills in English.

A passion for hardware security research and an interest in pursuing a PhD in this field would be highly valued. The internship offers the possibility of continuing toward a doctoral thesis, focusing on advancing the methodology for experimentally grounded fault modeling and its application to real-world security challenges.