Accessories

Generating a trigger pulse at the right point in time is essential in fault injection (FI) and side channel analysis (SCA) testing, but clock jitter and random program interrupts make this difficult, resulting in inaccurate timing.

The DS1002A Pattern Based Trigger Generator solves this problem by generating a trigger pulse after detecting a pattern in the EM signal of a chip. A special narrow band-pass filter enables pattern detection even in noisy signals.

The DS1112A 1064 nm Multimode Fault Injection Laser uses multimode laser diodes with a high power rating, enabling coarse chip surface scanning with large spot size and sufficient intensity within spot.

• 1064 nm wavelength NIR laser
• Laser pulse power: 30 W
• Configurable pulse length as small as 2 ns
• High pulse frequency allows multi-pulse fault injection attacks
• Short delay between trigger pulse and actual light pulse in combination with minimal jitter allows for accurate laser pulse timing
• Wide range of spot size: Choose from coarse to detailed chip surface scanning with objectives and spot size reducer
• Long-life laser diode with minimal aging
• Integrates with Keysight products DS1101A, DS1102A, DS1160A, and DS1180A

Injecting faults on an embedded device using power requires dedicated equipment. For a reliable glitch to be delivered to the target, the power supply needs to deliver sufficient power with minimal noise — and have sufficient power to generate steep voltage spikes. It is also necessary to monitor power consumption to identify areas of interest and see target behavior. The Keysight 30 A Amplifier combines these functionalities in one stand-alone component for targets consuming up to 10 A of current (peak-to-peak).

The DS1141A model provides the following features:

• Convenient add-on to Keysight’s Glitch Pattern Generator or Smartcard Voltage and Clock Glitcher to amplify the power glitches for an embedded processor
• Includes internal voltage and current monitor
• Includes two external power supplies

Keysight’s Inspector software enables full control of the EMFI probe setup, including probe positioning, XY stage movement, and camera operation. The platform supports automated test execution and streamlined reports to facilitate analysis and optimization of test results. The bidirectional probe can operate independently, within customized setups, or be integrated into existing user-defined hardware and software frameworks. 

With increasingly challenging chip packages and sophisticated light-sensitive sensors to prevent optical laser faults, this new testing vector for fault injection scenarios bypasses traditional measures and takes the next step in high-end security tests. 

The Keysight bidirectional fault injection probe offers the following features: 

• Includes New and Improved Amplifier Unit 
• Eliminates the need for chip de-packaging 
• Supports configurable, high-power EM pulses with interchangeable coils for varied field profiles 
• Allows precise adjustment of short, fast pulse characteristics via software 
• Reduces risk of permanent device damage compared to laser-based methods 
• Enables targeted bit flips within logic elements 
• Compatible with Keysight precision XYZ stages and multimode laser systems for automated scanning workflows 
• Supplied with standard EM-FI transient coils and a crescent-shaped ferrite probe 

Pinpoint vulnerabilities and improve security for electronic circuits in vehicles using the Keysight DS1170 automotive security test tool. Developers can easily integrate the tool in their existing test bench to execute predefined attack scenarios and establish a security baseline for either a specific electronic control unit (ECU) or a combination of ECUs. Accompanying software streamlines control of the automotive security test tool and interpretation of results. Optimize your security setup with the ability to control multiple DS1170 automotive security test tools with one dashboard and share information between them.

Complexity in cars is increasing constantly. While the increase in electronic units in vehicles allows for a better driver experience, it also increases the number of points an attacker can exploit. By adding the DS1170 to your vehicle security development testing, you can increase security measures and stay ahead of threats. Keysight’s protocol agnostic automotive security testing tool offers an all-in-one option for multiple security test scenarios. It offers the following features:

• Standard connectors to easily integrate the tool in your existing test bench
• Ability to record and replay control area network (CAN) messages to emulate an ECU
• Automated fuzzing capabilities to test the robustness of any ECU
• Traffic-driven triggering capabilities to extend your test scenarios with side channel analysis (SCA) and fault injection (FI)
• Prepared for ISO 21434
• Smart, active bus scanning in the discovery phase to record traffic
• Access to all low-level functions used in the predefined test scenarios to help you compose your own scenario
• Ability to analyze bus traffic in real-time and manipulate messages
• Use python or command-line for scripts

The DS1210A is a continuous-wave laser source with very precise power output. Use it for side-channel measurements based on failure analysis methodologies applied for side channel analysis.

• 1310 nm continuous-wave laser
• Single mode
• 500 mw
• Long-life laser diode for minimal aging
• Choose from coarse to detailed chip surface scanning with a 100:1 spot size range
• Use with DS1101A Fault Injection Laser System and DS1102A Dual Laser Fault Injection System
• Control optical power with DS1160A Smartcard Voltage and Clock Glitcher or DS1180A Glitch Pattern Generator

Protecting chips against laser fault attacks is one of the main security challenges in the smart card industry. With the DS1101A Fault Injection Laser System, perform advanced laser fault attacks that meet the highest international standards to assess if a smart card is secured against laser attacks. The DS1101A offers a set of new features meeting the latest timing and power requests from fault injection experts around the world. The special set of lasers with dedicated optics and ultra-fast and flexible control create the ultimate fault injection test solution. Its integration with the Inspector software further ensures that automation and analysis are covered by extendible modules which are flexible and easy to use.

• Supports front- and back-side attacks
• Integration with Inspector’s software and fault analysis modules
• Zoomable camera for easy navigation and automated Z-axis
• Fast multi-time glitching and accurate digital scaling with fast and predictable response to trigger pulse
• Multi-spot and IR navigation upgrades available
• Automatic scanning of a chip’s surface with integrated motorized XYZ stage
• Camera inspection of laser spot and location on chip area
• High repetition accuracy on motorized axes
• SDK available for integration into custom setups

The Keysight DS1121A bidirectional fault injection probe induces high power, electromagnetic (EM) pulses on a user-defined chip location. The fast and predictable pulse meets the demands of international testing laboratories and manufacturers.

Testers can control the set of probes, XY table, and camera with Keysight’s EM fault injection software, which also allows automation of testing scenarios and easy reporting for further analysis and refinements. Use the bidirectional fault injection probe in stand-alone or custom environments—or integrate with your own hardware and software.

With increasingly challenging chip packages and sophisticated light-sensitive sensors to prevent optical laser faults, this new testing vector for fault injection scenarios bypasses traditional measures and takes the next step in high-end security tests.

The Keysight bidirectional fault injection probe offers the following features:

• Does not require chip de-packaging
• Light sensor meshes do not detect EM glitches
• Flips value of logic cells on target device
• Offers lower chance of permanent chip damage compared to laser glitching
• Enables adjustable high power pulses and includes different coils to generate different EM fields over a chip
• Allows configuration of fast and short pulses with software
• Provides fast and predictable response to trigger
• Fits Keysight precision XYZ stage and multimode fault injection laser for automated scanning
• Includes standard EM-FI transient coils and one crescent probe ferrite

With increasingly challenging chip packages and sophisticated light-sensitive sensors employed to prevent optical laser faults, Keysight presents a new, powerful testing vector for fault injection (FI) scenarios on modern chips. The Unidirectional Fault Injection Probe induces fast, high-powered, electromagnetic pulses on a user-defined location of a chip. Unidirectional FI testing allows you to bypass traditional countermeasures and provides the next step in high-end security tests.

The DS1120A’s easy setup and testing process saves time, providing a fast and predictable pulse that meets international testing lab and manufacturer requirements. The set of probes, XY table, and camera offer a complete setup that testers can control and parameterize flexibly through the Inspector FI software. The software allows testing automation and easy reporting for further scenario analysis and refinements. The Unidirectional Fault Injection Probe can be used standalone or in custom environments as well as integrated with your own hardware and software. 

• Does not require de-packaging the chip
• Electromagnetic glitches not detected by light sensor meshes
• Flips value of logic cells on target device
• Lower chance of permanent chip damage compared to laser glitching
• Adjustable, high-powered pulses
• Different coils included to generate different electromagnetic fields over a chip
• Fast and short pulses configurable from software
• Fast and predictable response to trigger
• Fits Precision XYZ Stage of High Precision Electromagnetic Probe for automated scanning

Mounts on Precision XYZ Stage of High Precision Electromagnetic Probe with:

• 1 Crescent probe ferrite
• High Precision Fault Injection Probe Tips​

Countermeasures for fault injection are becoming more advanced. To bypass some of these countermeasures, a security evaluator needs to be able to generate multiple laser pulses at different locations. The DS1102A lets you generate two laser spots with independent location and timing.

• Work with different laser sources
• Speed up the evaluation process
• Perform multi-pulse attacks with DPSS laser
• Control automated scanning with Inspector and motorized positioning of both laser spots
• Achieve high position accuracy and resolution
• Use the wide field of view to create a relatively large distance on die between two laser spots

The DS1114A 1064 nm Diode Pumped Solid State Fault Injection Laser complements diode lasers and boasts better fault injection features compared to laser cutter systems.

• NIR laser with 1064 nm wavelength
• Short trigger time
• Easy control of output power
• Short pulse duration (5 kW)
• Avoids degradation, providing the same output over time

The High Precision Electromagnetic Probe, a highly sensitive probe used in side channel analysis, picks up electromagnetic emissions from semiconductor circuits. The probe has a mechanism that allows you to swap out three different probe tips of varying sizes: 0.2 mm, 0.5 mm, and 1.25 mm. All tips have a directed coil and a protective Teflon shell. Normally used in combination with an XYZ-motion platform, the probe can pick up electromagnetic fields with frequencies of up to 6 GHz, converting them into an AC signal.

By moving over the surface of a target, the DS1203A can find highly active circuits, or hotspots. The signals picked up on a hotspot comprise the measurements for simple or differential electromagnetic analysis. The High Precision Electromagnetic Probe has a variable gain mechanism, which you can set by hand or through an external device such as the Spider and can vary based on the target’s characteristics.