Batoul Attar
email: attar@insa-toulouse.fr

Jean-Charles Mare
email: mare@insa-toulouse.fr

Assessment of Electric Drive for Fuel Pump using Hardware in the Loop Simulation

Keywords: Electric drive, Fuel system, Hardware in the loop (HIL), Matlab/Simulink, Power by wire (PBW), Real-time simulation

The present communication deals with the evaluation of electric drives used in fuel system by using Hardware In the Loop (HIL) methodology. At the designing stage of electric drive, there are a lot of choices concerning electric motor technology (DC motors, AC motors, BLDC motors, PMSP motors) while there may be a lot of uncertainty in working environment, mission profile and control strategy at fuel pump level. For these reasons, HIL is suggested as solution that permits to test different motor technologies regardless the applied load. The outcome of HIL will be the most effective motor for studied application. Thermal model and power supply model are presented in this paper to be integrated in real-time model with tested electric motor model, to get virtual prototype closer to the real system. As a result, observations and restrictions of HIL methodology are presented, which point up the impact of the selection of the real motor and its drive.

Introduction

Hybrid Electric Vehicles (HEV) or totally Electric Vehicles (EV) are the new tendency in transport vehicles industry for many reasons. The first one is to protect the environment by reducing fuel consumption, e.g. CO 2 emission by 35% that is equivalent to more than a 50% increase in fuel economy 1 [START_REF] German | Hybrid vehicles: Trends in technology development and cost reduction[END_REF]. Furthermore, more electric vehicles will get desirable characteristics of electrical systems, such as controllability, re-configurability, and advanced diagnostics and prognostics which assure more intelligent maintenance. So, better performance and long life time for transport vehicles will be achieved.

In the field of power transmission and control, more electric vehicles involve more electrical signaling and powering of drives that still employ internally hydraulic and mechanic devices: air conditioning compressor, fuel systems (pumps, injection, air intake geometry,…) [START_REF] Rashid | Power Electronics Handbook, Devices, Circuits and Applications[END_REF]. Electrically signaled (Signal-By-Wire) systems use electrical transmission of commands, sensors data, mode selection, diagnostic etc. Electrically powered (Power-By-Wire) systems supply drives with electric power, e.g. inlet guide vane actuator for engines or electro-hydrostatic actuators (EHA) for flight controls. Combining SbW, PbW and local hydraulic system can therefore take the best of all technologies for power transmission systems [START_REF] Jian | Incremental Virtual Prototyping of Electromechanical Actuators for Position Synchronization[END_REF]. 1

Inverse of fuel consumption

In this communication more electrical drives will refer to (Power-By-Wire). A closer look will be taken on engines fuel systems. Using electrical drive for the low pressure fuel pump will insure better start/priming of the engine whatever environment conditions or the topology of the system, where in some application the pump is far away from the tank, e.g. for helicopters.

In fact, during priming stage, the pump has to get off the existing air in fuel system pipes, and then deliver the fuel to the fuel metering unit. Dealing with different fluids (air and fuel) during suction phase needs different amount of driving power. Nevertheless, choosing an adequate electrical drive to the fuel pump requires knowing the exact needed power, in order to size the drive properly. This is difficult to calculate because of mixed flow at priming stage. So, drive sizing remains inaccurate at the beginning of design stage of electric derive system. Furthermore, there is a large variety of electric drive technologies that can be used in transport industry which makes the selection sometimes difficult when all aspects are to be considered (thermal balance, command and control strategy, consumed energy, natural dynamics, etc.).

The main types of electric motors used in motion control are, according to [START_REF] Zeraoulia | Electric Motor Drive Selection Issues for HEV Propulsion Systems: A Comparative Study[END_REF] They are different in their operating principle as well as their weight, size, costs and even in the power drive electronics (PDE) that they require. When there is uncertainty in power which is needed to drive the fuel pump, a definitive motor cannot be chosen. Moreover, there is also a high level of uncertainty in stage of electric drive design, concerning drive technology, working environment, mission profile and control strategy. This uncertainty requires a new methodology to deal with it in the early phases of a project. This paper presents the Hardware In the Loop (HIL) simulation as a methodology to figure out the appropriate electrical drive for the low pressure pump of an helicopter fuel system. HIL will combine a virtual drive (simulation) with the real fuel pump and fuel metering unit (hardware). In that manner, it will enable changing by simulation the type, command and control strategy while keeping realism by using the real drive load.

The main interest of using HIL comes from the support it provides for the selection of drive technology, its sizing, the assessment of command strategies, including for different operating, and even the capability to virtually inject faults in the simulated components to assess response to failure at overall system level.

Methodology of HIL

HIL is a vital step in design V cycle, for rapid prototyping, testing, evaluation and validation of components as well as during the design stage to get the best of new systems. It has numerous advantages, among them [START_REF] Köhler | Enhancing Embedded Systems Simulation, A Chip-Hardware-in-the-Loop Simulation Framework[END_REF]

State of the art

Developing electric drives for innovative hybrid systems requires numerous tests, which are sometimes difficult, costly or even impossible to arrange [START_REF] Heikkinen | Real-time HIL-simulation for testing of electric motor drives emulating hydraulic systems[END_REF]. HIL can facilitate and speed up the testing of new configurations of hybrid systems and gets benefit and advantages of virtual testing combined with real physical plants characteristics [7] [9].

General configuration of HIL that used in electric or hybrid vehicles is well discussed in literature [10] [7]. Two kinds of studies have been identified. The first one focusses on the testing of electric drives to assess the merits of different control strategies under various operating conditions and fault conditions, as in [11] [12]. The second one deals with the simulation of the load to be driven electrically which is often the hydraulic pump for fluid power applications.

Concerning electrically-driven pumps, HIL was used to get more information about hydraulic system performance at different working conditions (normal operation, under loading or overloading), as in [START_REF] Vodovozov | Modeling and Analysis of Pumping Motor Drives in Hardware-in-the-Loop Environment[END_REF]. It was also employed to facilitate the selection and testing of components for innovative hydraulic systems through the support of real time simulation instead of adding or removing real hydraulic and mechanical components [START_REF] Heikkinen | Real-time HIL-simulation for testing of electric motor drives emulating hydraulic systems[END_REF]. For example, it was used to show the possibility of replacing conventional hydraulic supply and control of power (e.g. involving proportional valves) by and electro-hydrostatic module (speed-controlled electric motor and fixed displacement pump) to control rod position of this cylinder [START_REF] Heikkinen | Real-time HIL-simulation for testing of electric motor drives emulating hydraulic systems[END_REF]. Moreover, in literature of HIL for electrically-driven pumps, a special interest is payed to define an optimum electric motor that loads the electric drive under test in order emulate the mechanical power required by the pump, as in [START_REF] Heikkinen | Modelling study of an optimum electric motor for directly driven hydraulic pump emulator in real-time HIL-simulation[END_REF] [15] regardless the electric drive to be employed in the final product. Contrary, there are not similar studies to support the definition and the assessment of the electric drive. The present communication addresses this need that can be found when there are different candidates for electric motor and drive architectures and technologies. Real-time simulation of the candidate solutions can efficiently support decision making, in particular when the mechanical characteristic of driven load is badly known and cannot be simulated. In this case, the test bench combines the real load and an electric drive that is controlled in order to behave like the candidate electric drive.

There are already some recommendations for HIL that can be found in literature as [START_REF] Heikkinen | Real-time HIL-simulation for testing of electric motor drives emulating hydraulic systems[END_REF] [10], either for general use or for electrically-driven pumps.

Unfortunately, these recommendations are vast, too much general and do not emphasize on the choice of electric drive, given the existing load to be driven. This type of HIL is addressed in this communication.

Table 1 summarizes a part of work that is presented in literature concerning HIL for electrically-driven pump in addition to what is considered in this paper.

Actual need of HIL

The physical plant of HIL, which is presented on the Figure 1, contains the electric motor with its power drive electronics (PDE), the fuel pump and the fuel metering unit (the fuel system components are kept to reuse a mature technology). On the other hand, the real electric motor is taken commercially-off-the-shelf and is chosen without any constraints of airworthiness. In the present study, the real electric motor has been chosen among 60 suppliers datasheets to display high performance (low inertia, torque/power capability suited to the estimated need with sufficient margin).

The main interest of the proposed HIL comes from the possibility to force the real electric motor to operate like a given motor, the virtual motor that is representative of the effective motor that would be specified, designed, manufactured and installed on the engine. The model of the virtual motor is developed in order to be consistent with real-time simulation constraints (e.g. sampling period between 1 and 5 ms). The provided torque is calculated by real-time simulation as a function of its rotor velocity and of the command signal. It is then sent to the real motor drive as a torque setpoint (torque bandwidth greater than e.g. 1000 Hz). The real motor speed is measured to feed the simulation model.

Selection of electric motor

One of the most important driver to use HIL methodology here is the uncertainty that affects the selection of appropriate electric motor for the intended application. As mentioned before, there are at least five electric motor technologies that can be used in our application. Figure 2 summarizes most used electric motor in Hybrid and Electric Vehicles and their appropriate PDE: Indeed, the most important factors in choosing a motor according to [START_REF] West | DC, induction, reluctance and PM motors for electric vehicles Electric[END_REF] are weight, efficiency and cost. These factors can be combined with application requirements. For example, AC motor which the best motor for Hybrid and Electric Vehicles is no more a good choice for aeronautics application because of its mass, which can be twice that of PMSMs or BLDCs motors, without their PDE, [START_REF] West | DC, induction, reluctance and PM motors for electric vehicles Electric[END_REF].

Concerning the present application, the required motor has to supply a continuous nominal torque typically 0.5 N.m and its maximum speed is 10000 rpm. Electric power supply is imposed by aerospace standards. A wide search has been done for different types of electric motors, among 60 offthe-shelf references (25 BLDC, including 5 pancake hollow shaft, 17 DC, 12 AC), there were only 5 as potential candidates even though they did not meet all required criteria. Furthermore, some suppliers of potential motors needed a business plan to accept delivering a few samples, which was not available at this stage of the project.

For these reasons, HIL was selected as a methodology to test different motor designs and help to facilitate the development of the electrically-driven pump.

Ref Real part Virtual (simulated) Part

Objective of HIL [START_REF] Heikkinen | Real-time HIL-simulation for testing of electric motor drives emulating hydraulic systems[END_REF] Electric drive + Motor emulating the hydraulic pump with PDEs Hydraulic system (components of hydraulic mobile machine, ex. Industrial forklift)

To simplify the components choosing and testing for new hydraulic system [START_REF] Heikkinen | Modelling study of an optimum electric motor for directly driven hydraulic pump emulator in real-time HIL-simulation[END_REF] and [START_REF] Heikkinen | Electric motor based hydraulic motor pump emulator in real time HIL-simulation : Finding the optimum emulator electric motor[END_REF] Electric drive + Motor emulating the hydraulic pump with PDEs

Hydraulic and mechanical components of hybrid drive of off-road mobile machinery

To choose the optimum electric motor that emulates the hydraulic pump. According to required refresh rate of electric motor's torque control loop, motor parameter limit values are suggested for required motor [START_REF] Vodovozov | Modeling and Analysis of Pumping Motor Drives in Hardware-in-the-Loop Environment[END_REF] Electric

HIL configuration

As it is described previously, HIL contains two parts; the first one is the software part which contains a real-time model representing a tested virtual electric motor and its drive. Moreover, many submodels can be developed to predict performance at different operation conditions. As addressed later, this can help to test the effect of supply voltage and thermal equilibrium of the simulated motor.

The second one is the hardware part. The real motor is used to drive the load under test according to the simulated motor characteristic. A second real motor is used in the present case in order to load the first motor without waiting the real fuel pump and fuel metering to be available for testing. The test bench hardware includes the two motors and their PDE, additional torque/speed/temperature sensors, displays, two computers (PC for configuration and data analysis and PC to run real-time submodels) and real-time target machine which interfaces with PDEs and sensors and runs the realtime simulation.

Figure 3 shows a simple representation of HIL configuration: The real-time model contains essentially a model of simulated electric motor. The complexity of this model can be increased step-by-step (as far as real-time constraints are met) by integrating other sub models, in order to reproduce different aspect that affects motor performance. In this paper, a thermal model is presented to take into account the effect of temperature on the motor performance, including its impact on windings resistance or heat exchange with surrounding environment. Second presented submodel is used to assess the effect of power supply variations. Figure 4 displays how these models interface through power variables: voltage and current delivered by electric supply (U ob , I), heat power and motor temperature (P losses , T w ).

Figure 4: Different submodels developed for real-time simulation

Modelling of electric motor

As the main interest of the proposed HIL approach is to force the real electric driving motor on the test bench to operate like any given motor, named the simulated or the virtual motor. Therefore, the shaft torque of the two motors is identical, as far as friction and inertia of the coupling element are negligible with respect to the rated torque.

The approach is illustrated for two motor technologies, DC motor and AC motor as virtual motor. The shaft torque of the simulated motor will be transmitted to the driving motor of the test bench as torque setpoint, as presented in Figure 1.

Thus, shaft torque of the simulated and real motors shall be identical at any time, as illustrated in Figure 5 and eq. ( 1):

𝐶 𝑠𝑠 = 𝐶 𝑠𝑟 (1)
with C ss , C sr are shaft torque of simulated motor and real motor (N.m), respectively.

On a motor, the shaft torque equals to the electromagnetic torque minus the dissipative torque due to friction and the inertial torque due to the rotor inertia. Assuming the speed to not reverse in the present pump drive application and friction to be made of pure Coulomb and viscous effects brings, as presented in (2):

C 𝑠𝑠 = 𝐶 𝑒𝑠 -𝑓 𝑠 𝜔 -𝐶 𝑓𝑠 -𝐽 𝑠 𝜔̇ C 𝑠𝑟 = 𝐶 𝑒𝑟 -𝑓 𝑟 𝜔 -𝐶 𝑓𝑟 -𝐽 𝑟 𝜔̇ (2)
with C e electromagnetic torque produced by the motor (N.m), f coefficient of viscous friction (N.m.s/rad), C f Coulomb friction torque (N.m), J inertia of the motor rotor (Kg.m 2 ),  rotary speed of the motor shaft (rad/s), 𝜔̇ motor shaft angular acceleration (rad/s 2 ). Subscripts r and s are associated with the real and the simulated motors, respectively.

Thus, according to (1) and (2), the electromagnetic torque setpoint which will be sent to the real motor drive is:

𝐶 * = 𝐶 𝑒𝑟 = 𝐶 𝑒𝑠 -(𝐶 𝑓𝑠 -𝐶 𝑓𝑟 ) -(𝑓 𝑠 -𝑓 𝑟 )𝜔 -(𝐽 𝑠 -𝐽 𝑟 )𝜔̇ (3)
with C* electromagnetic torque setpoint (N.m)

Figure 5 represents a simplified torque calculation for two motors:

Simulation of a DC Motor

The electromagnetic torque of the simulated permanent magnets DC motor is:

C 𝑒𝑠 = 𝐾 𝑚𝑠 𝐼 𝑠 (4)
with K ms torque constant of simulated motor (N.m/A), I s current supplied to the simulated motor (A). This current can be calculated from eq. ( 5):

𝑈 𝑜𝑏 = 𝐾 𝑚𝑠 𝜔 + 𝑅 𝑠 𝐼 𝑠 + 𝐿 𝑠 𝑑𝐼 𝑠 𝑑𝑡 (5)
with U ob voltage supplied to simulated motor (V), R s and L s rotor windings electrical resistance () and inductance (H) of simulated motor, respectively.

From equations (3) ( 4) and ( 5), the electromagnetic torque setpoint becomes:

𝐶 * = 1 𝐻(𝑠) [𝐾 𝑚𝑠 1 𝑅 𝑚𝑠 + 𝐿 𝑚𝑠 𝑠 (𝑈 𝑜𝑏 -𝐾 𝑚𝑠 𝜔) - -(𝐶 𝑓𝑠 -𝐶 𝑓𝑟 ) -(𝑓 𝑠 -𝑓 𝑟 )𝜔 -(𝐽 𝑠 -𝐽 𝑟 )𝜔̇] (6)
with H(s) dynamics of the real motor PDE torque loop.

Eq. ( 6) can be presented in block diagram as in Figure 6: The next virtual motor to be tested as virtual motor is a three phase induction motor.

First of all, a static model is used to reproduce the motor torque-speed characteristics. Then, a dynamic model is tested to induce an electromagnetic torque as a function of motor current and parameters.

In the first model, the motor torque is extracted from characteristics curve presented in motor datasheet as a function of motor speed. These data can be implanted as a data table in the real-time model.

Concerning the second model, the motor torque is calculated as a function of current in Park's coordinates. According to [START_REF] Leedy | Simulink / MATLAB Dynamic Induction Motor Model for Use as A Teaching and Research Tool[END_REF] [18] the electromagnetic torque in squirrel cage AC motor is given by:

𝐶 𝑒𝑠 = 3 2 𝑃 2 𝐿 𝑚 (𝑖 𝑞𝑠 𝑖 𝑑𝑟 -𝑖 𝑑𝑠 𝑖 𝑞𝑟 ) (7)
with P number of poles, L m mutual or magnetizing inductance (H), i motor current (subscript s is for stator current, r for rotor, d for direct axis and q for quadrature axis in Park's coordinates).

These currents can be calculated as a function of motor design parameters, such as rotor inductance, stator inductance, mutual inductance, flux linkage in the motor and electrical speed of the rotor, as it is presented in [START_REF] Leedy | Simulink / MATLAB Dynamic Induction Motor Model for Use as A Teaching and Research Tool[END_REF] [18].

Thermal model

Importance of thermal analysis

Thermal performance analysis of electric motors is a crucial step during design phase to insure long lifetime and reliable performance of the motor. Indeed, electric machines lifetime is specified by temperature at which their winding electrical insulations are exposed, which is for example (85°C, 100°C, 125°C, 155°C) [START_REF] Motor | Thermal Calculations of Motors[END_REF]. So, higher temperature means shorter motor lifetime, and vice versa, where motor lifetime is reduced to half each time the temperature increases 10°C above its value at which the lifetime is calculated. For instance, if a motor has a normal lifespan of 8 years at an average temperature of 105 °C, it becomes 4 years at 115 °C, 2 years at 125 °C and one year only at 135 °C [START_REF] Théodore | Electrotechnique[END_REF].

Not only motor lifetime is affected by temperature, but also its performance fluctuates with motor electromagnetic parameters variation versus temperature. For instance, the permanent magnets induction decreases by 4% for SmCo 5 and by 12% for sintered NdFeB when their temperature increases about 100°C. Similarly, the resistance of copper winding increases by 42% when its temperature increases by 100°C. The convective heat exchange coefficient for horizontal exchange surface at 20°C ambient increases by 38% as the exchange surface temperature rises from 50°C to 150°C, and finally the voltage drop at rated current and commutation energy for one IGBT, a widely used power transistor in PDE, rises by 25% as its temperature changes from 25°C to 125°C [21] [22].

In fact, thermal analysis is a quite complex phenomena because electromagnetic losses increase motor temperature, so motor parameters such as electric resistance R and induction B (density of flux magnetic) will change with temperature, as eq. ( 11) illustrates. As a result, copper losses will increase with the increasing of electric resistance and also iron losses with induction rise, which leads to more heating, and the loop continues, making a snowball effect.

At last and not least, thermal analysis is helpful to detect fault in the motor, which occurs if the temperature exceed its estimated value in normal operation, as in [START_REF] Silva | Multi-Domain Model for Electric Traction Drives Using Bond Graphs[END_REF].

Electric motor losses

Losses are the main sources of heating in the electric machines. Generally in electric motors, the main losses are cooper losses, also known as Joule power losses, which depends on coil current and ohmic resistance, it can reach 30% of input power [START_REF] Motor | Thermal Calculations of Motors[END_REF]. In second place are iron losses, which contain eddy current losses and hysteresis losses and depend on motor rotational speed. They can reach about 10-20% of the rated torque [START_REF] Motor | Thermal Calculations of Motors[END_REF]. In third place, mechanical losses present as friction losses in bearings and at graphite brushes for DC motors, which is proportional to motor rotational speed, and viscous friction of rotor in the air-gap which is proportional to square of motor speed [START_REF] Lacroux | Les actionneurs électriques pour la robotique et les asservissements, 2e édition[END_REF]. Brushes friction losses of graphite brushes are about 5% of rated torque but they are less that value for precious metal brushes [START_REF] Motor | Thermal Calculations of Motors[END_REF].

Furthermore, stray losses which regroup electromagnetic losses that cannot be classified in previous losses. They occur for different raisons, for example because of a nonuniform current distribution in copper winding or because of the magnetic flux which is produced by the load current and which leads to additional iron losses. Generally, it is considered as a percentage of output power (3 to 5%) for small electric machine (less than 10kW) [START_REF] Andrada | Power Losses in Outside-Spin Brushless D . C . Motors[END_REF].

Brush losses disappear in permanent magnet BLDC motor where the dominant losses are electromagnetic losses, which combine copper and iron losses. For example, it is about 80% of total losses whereas bearing losses are about 12%, going up with increasing motor speed or load [START_REF] Kuria | Modeling Power Losses in Electric Vehicle BLDC Motor[END_REF]. However, friction losses are neglected in most of studies of permanent magnet synchronous machines (PMSM), like in [27][28].

In this paper, motor total losses are divided into two parts, the first on is copper losses and the second one is stator iron losses which integrated frictional losses. Heat generated in permanent magnets from viscous friction losses are supposed small in comparison with iron losses. Next equations present PMSM losses [START_REF] Andersson | Real time thermal model for servomotor applications[END_REF] :

𝑃 𝐶𝑢 = 3 𝑅 ∅ 𝐼 ∅ 𝑟𝑚𝑠 2 𝑃 𝐹𝑒 = 𝑃 ℎ𝑦𝑠 + 𝑃 𝑒𝑑 𝑃 ℎ𝑦𝑠 = 𝑘 ℎ𝑦𝑠 𝐵 𝑚𝑎𝑥 2 𝑓 𝑃 𝑒𝑑 = 𝑘 𝑒𝑑 𝐵 𝑚𝑎𝑥 2 𝑓 2
𝑃 𝑙𝑜𝑠𝑠𝑒𝑠 = 𝑃 𝐶𝑢 + 𝑃 𝐹𝑒 [START_REF] Heikkinen | Real-time HIL-simulation for testing of electric motor drives emulating hydraulic systems[END_REF] with P losses total losses in electric motor (W), P Cu copper losses (W), P Fe iron losses (W), P hys magnetic hysteresis losses (W), P ed eddy current losses (W), R  electrical resistance of one phase (), I  current of one phase (A), B max maximum flux density (T), f frequency flux variation (Hz), k hys hysteresis constant and k ed eddy current constant.

k hys , k ed are constants determined by the manufacturer provided loss data (k hys is a constant whose value depends on the ferromagnetic material and the volume of the core. k ed is a constant whose value depends on the type of material and its lamination thickness [START_REF] Sen | PRINCIPLES OF ELECTRIC MACHINES AND POWER ELECTRONICS[END_REF]).

Thermal model with constant electrical resistance

The objective here is to show the ability to integrate the thermal model in the HIL real-time model. Considering the selected environment, the thermal model will be presented in form of block diagram which facilitates its integration with the global real-time model in Matlab/Simulink.

A simple thermal model is given by:

𝑃 𝑙𝑜𝑠𝑠𝑒𝑠 = 𝑃 𝑅 + 𝑃 𝐶 𝑃 𝑙𝑜𝑠𝑠𝑒𝑠 = ∆𝑇 𝑅 𝑡ℎ + 𝐶 𝑡ℎ 𝑑 𝑑𝑡 (∆𝑇) (9)
with P R exchanged heat power with surrounding environment and P C (W) stored heat power in thermal capacitance, R th thermal resistance (°K/W), C th thermal capacity (J/°K) and T temperature difference between domain and environment (°K).

The heat power exchange is split in 2 parts; with the ambient P a and with the hydraulic pump P p . It is assumed at first that the first exchange occurs by natural convection and the second one is by conduction.

The simplest thermal model is to consider the whole motor as a single body. Nevertheless, the presented thermal model studies the winding separately from the motor frame. So, it has two thermal capacitances, C thw for winding and C thf for frame. The propagation of heat flow in the motor is from hot winding, towards the frame by conduction then to ambient through natural convection. So, the two bodies thermal model is presented in [START_REF] Mohammed | Real-time simulation of electric machine drives with hardwarein-the-loop[END_REF] and Figure 7:

𝑃 𝑙𝑜𝑠𝑠𝑒𝑠 -𝑃 𝑤𝑓 = 𝐶 𝑡ℎ𝑤 𝑑𝑇 𝑤 𝑑𝑡 𝑃 𝑤𝑓 + 𝑃 𝑝 -𝑃 𝑎 = 𝐶 𝑡ℎ𝑓 𝑑𝑇 𝑓 𝑑𝑡 𝑃 𝑤𝑓 = 1 𝑅 𝑡ℎ𝑤𝑓 (𝑇 𝑤 -𝑇 𝑓 ) 𝑃 𝑓𝑎 = 1 𝑅 𝑡ℎ𝑓𝑎 (𝑇 𝑓 -𝑇 𝑎 ) 𝑃 𝑝𝑓 = 1 𝑅 𝑡ℎ𝑝𝑓 (𝑇 𝑝 -𝑇 𝑓 ) (10)
with R thwf , R thfa , R thpf thermal resistances between windings and motor frame, between motor frame and ambient, between the pump and the motor frame (°K/W), respectively. C thw , C thf are thermal capacitance of motor winding and motor frame (J/°K), respectively. T f , T w , T a , T p are temperatures of motor frame, motor winding, ambient and pump (°K), respectively.

Two bodies thermal model of an electric motor is presented in Figure 7: The PDE losses are beyond the objective of the reported work.

Thermal model with varied electrical resistance

The electrical resistance and all electric motor parameters mentioned in the datasheet are measured at a constant temperature, named catalog temperature T C which usually equals 25°C. Nevertheless, as mentioned before, electric resistance, as many other motor parameters, varies with motor operating temperature. It can be calculated as a function of its reference value R (TC) , at reference T C and winding temperature T W as in eq. [START_REF] Poon | Hardware-in-the-Loop Testing for Electric Vehicle Drive Applications[END_REF].

𝑅 (𝑇 𝑤 ) = 𝑅 (𝑇 𝑐 ) [1 + 𝛼 𝑐𝑜𝑝𝑝𝑒𝑟 (𝑇 𝑤 -𝑇 𝐶 )] (11)
with R (Tw) and R (TC) electrical resistance at actual temperature T w and catalog temperature T C in (), respectively.  copper is temperature coefficient of winding, which is equal to 0.0039 (°K -1 ) for copper.

Figure 8 represents thermal model of electric motor with temperature sensitive windings resistance:

Figure 8: Block diagram of thermal model with temperature sensitive windings resistance

There is no special issue to consider the influence of temperature on magnetic induction. The process to modify the original model is Figure 7 remaining unchanged.

Model of power supply of on-board network

Another objective of the present work was to assess the impact of supply power. In the considered application, the on-board power supply is continuous DC voltage delivered by battery, according to the MIL_STD_704F and RTCA-DO160F standards [START_REF]RTCA DO-160F, Environmental Conditions and Test Procedures for Airborne Equipement[END_REF], [START_REF]Military Standard, Aircraft Electric Power Characteristics[END_REF].

The supplied voltage is not constant, in particular if other consumers (e.g. starter) draw high power during the operation of the motor under study. This dynamic change of supply voltage is particularly important, especially if the electric motor is to be simulated is supplied directly without PDE.

The following intends to illustrate with a simple example how the supply conditions can be introduced in the simulated drive. Generally, the power supply of electrical on-board network depends on battery voltage, its internal resistance and the consumed current, as mentioned in [START_REF] Choi | Design and Temporal Analysis of Hardware-in-the-loop Simulation for Testing Motor Control Unit[END_REF]:

𝑈 𝑜𝑏 = 𝑈 𝑏𝑎𝑡 -𝑅 𝑖 𝐼 (12)
with U ob power supply of the on-board electrical network (VDC), R i internal resistance of the battery () and I consumed current in the electrical circuit (A). This current represents the sum of electrical currents consumed by different electrical devices supplied.

This can be implemented extending the model of Figure 7 as given in Figure 9: A major power consumer is the engine DC starter that is simple starter DC motor, which turns-on when the studied electric pump motor is running. The consumed current is:

𝐼 = 𝑈 𝑏𝑎𝑡 -𝑘 𝑠 𝜔 𝑠𝑡𝑎𝑟𝑡𝑒𝑟 𝑅 𝑖 + 𝑅 𝐿 + 𝑅 𝑠 (13)
with R L , R s electrical resistance of network cables and of starter motor (), respectively,  starter and k s the rotary speed (rad/s) and motor constant (V.s/rad) of the starter motor.

Thus, the block diagram model of the effective supply conditions of the motor under study can be added as illustrated by Figure 10:

Hardware configuration

A specific test bench has been designed to support the assessment of the proposed HIL approach. Its architecture has been introduced in Figure 11 and Figure 12. It consists of :

 A mechanical assembly with the frame that supports the driving and loading motors. The two motors are connected face to face by means of mechanical couplings and torque transducer, Figure 12.

 The rack with two motors PDEs and the electric supply unit (ESU).

 The real-time simulator, which consists of a personal computer for configuration and data analysis and a real-time board which interfaces with the PDE and the sensor and runs the real-time model. The two PDE are identical, "Microflex e150" with rated of current of 6A. Interfaces with the real-time board are either analogue or through EtherCAT bus.

The torque transducer was selected from "Magtrol" with rated torque of 5 N.m and maximum speed of 20000 rpm. Suitable couplings were picked from the same supplier "Magtrol" to protect against the effects of misalignment.

The real-time target machine is "Speedgoat" which has 6 Test results and lessons learned

Experiments

The first simulated drive was brushed DC motor that was directly connected to the simulated DC supply without any PDE. The motor was Maxon 353295 (rated output power 250 W, nominal voltage 24V, nominal speed is 3810 rpm, nominal torque 0.501 N.m and inertia 1.29 Kg.cm 2 ). The simulated drive was implemented as presented on Figure 6.

An AC motor was also simulated as a Woodward AC motor (4 poles, frequency 400 Hz, synchronous speed 12000 rpm, and inertia 9.8 Kg.cm 2 ).

For all real-time simulations, the sampling rate was 1 ms. The average TET (total elapsed time) to run the models did not exceed 0.0213 ms with a max value lower than 0.026 ms.

Lessons learned

The reported work intended to use of-the-shelf hardware to implement a HIL platform for emulating a motor drive. The experience acquired can be summarized in terms of lessons learned and recommendations that concerns mainly the hardware: The torque produced by the real motor at shaft interface is far different from the electromagnetic torque produced by its PDE. This is due to motor shaft friction (bearings, seals and windage) and motor rotor inertia. PDEs generally include an estimate of these values as a feedforward action in the motor control. Moreover, the current (or torque loop) ignores the effective electromagnetic torque produced as it only uses windings current measurements. Finally, although these effects are compensated in the PDE control algorithm, the motor torque at shaft interface is not accurately related to the torque setpoint, generating errors in the HIL process. This requires an accurate identification of these effects to feed the compensators that can be either implemented in the PDE or in the real-time simulation, as given by equation [START_REF] Köhler | Enhancing Embedded Systems Simulation, A Chip-Hardware-in-the-Loop Simulation Framework[END_REF].

b) Dynamics

The potential dynamic effects that might be intended to simulate for the virtual drive can be listed from the slowest to the fastest (typically): In practice, what can be simulated is constrained by hardware. The real-time platform, a basic one, could run quite complex models at a sampling rate of 0.05 ms. This is consistent with the simulation of motors electric time constant and even torque (or current) loop dynamics. The main limitation came for the industrial electric drive that was used in torque control mode from external setpoint. Whatever the type of data interfacing (analog, digital bus), electric power drives sample the data exchanged (here torque setpoint input and effective velocity output) at 1 ms to 5 ms. This is the main limitation factor for simulating highest dynamics. The best option is definitely to input the torque demand directly at the PWM input to take benefit of its high frequency, typically 8 kHz to 16 kHz (62.5 s to 125 s).

c) Difference in motor rotor's inertia

As pointed out by equation ( 6), the torque setpoint involves the compensation of the difference between the simulated motor and the effective motor rotors inertia. Consequently, the measured rotor speed signal has to be time-derivated to calculate this member. Unfortunately, the speed signal is generally noisy and cannot be differentiated without noise (or phase lag if filtered efficiently). As for loading test benches, the best approach when possible is to use a real motor with the lowest inertia and to increase it through additional bodies to exactly reproduce the inertia of the simulated motor. In practice, this option is not always easy to implement as the used motor has to be interfaced with the real load, generally through adaptation joints that increase inertia (especially if a torque transducer is inserted). This is a severe limitation.

d) Causality

The proposed implement of HIL consists in generating the torque setpoint demand as a function of actual measured rotor velocity. This solution was logically selected as the torque loop is faster than the speed loop. However, the other option was tested that consisted in generating the speed demand as a function of the transmitted torque. As anticipated, performance was extremely low, due to the impact of the real motor speed loop dynamics.

Conclusion

The present paper has dealt with hardware in the loop (HIL) as a methodology to support the specification of electric drives in the presence of high uncertainty on the driven load power characteristic. It was intended to drive the load with off-the-shelf high performance BLDC motor and power drive electronics to emulate the candidate electric drive. The approach was applied to an electrically-driven fuel pump.

The first part of the paper introduced the proposed HIL architecture that consists in simulating in real-time the emulated electric drive and supply by generating the motor torque to be developed on the driven load as a function of the motor shaft angular velocity. Simple examples have been provided to illustrate how the supply conditions, the motor dynamics and the thermal effects can be included in the real-time simulation.

It was shown that there is no issue in reproducing the motor steady-state power characteristic as well as the thermal effects that significantly impact the electric drive sizing and effective service life. However, three main lessons have been learned and come from the limitations introduced by hardware. First, the used motor has to be identified with care. This is mandatory to get the expected torque at shaft through accurate compensation of friction, inertia and current/torque characteristic. Secondly, industrial power drive electronics sampling of setpoint and measured signals (1 to 5 ms typically) strongly limit the ability to simulate in real-time the motor dynamics. Oppositely, real-time hardware was not found to be limitative as models could be simulated with only a few tenths of microseconds step. Last, the difference between the inertia of the simulated and the used motor rotors is difficult to compensate efficiently due to noise or phase lag effect. It is therefore recommended to setup the test bench in such a way that the effective rotor inertia equals the simulated motor one.

Nomenclature

  [START_REF] Badin | Les Véhicules Hybrides des composants au système[END_REF]:Brushed Direct Current motors (DC)  Brushless DC motors (BLDC)  Permanent Magnet Synchronous Motors (PMSM)  Asynchronous Motors or Induction Motors (AC)  Synchronous Reluctance Motors (SRM)

Figure 1 :

 1 Figure 1: HIL structure The virtual motor model is developed in order to simulate the following effects:  Power capability (torque vs. velocity)  Dynamics (of drive, effect of motor inertia)  Energy consumption  Temperature of the windings and motor frame, vs environment conditions, with impact  Response to fault (e.g. short circuit of windings or open leg of inverter)  Impact to the drive architecture and control (brushed/brushless motor, 6-step or field oriented control, sensorless speed control, etc.)  Impact of the engine starting strategy (e-pump, starter, igniter, etc.).

Figure 2 :

 2 Figure 2: PDE versus motor type

Figure 3 :

 3 Figure 3: Simple representation of HIL configuration

Figure 5 :

 5 Figure 5: Simplified representation of the torque calculation for the simulated and real motors

Figure 6 : 5 . 1 . 2

 6512 Figure 6: Calculation of the electromagnetic torque setpoint for the simulation of a DC motor 5.1.2 Simulation of an AC Motor (Induction type)

Figure 7 :

 7 Figure 7: Block diagram of two bodies thermal model of an electric motor

Figure 9 :

 9 Figure 9: Simple model of on-board power supply

Figure 10 :

 10 Figure 10: Model of power supply including battery, wires and starter motor (as an example)

Figure 11 :

 11 Figure 11: Test bench hardwareUsed motors are off-the-shelf commercial BLDC motors from ABB. Rated torques are 0.9 N.m and 1.36 N.m for the driving and loading motors, respectively. The motors were chosen for their low rotor inertia (0.124 Kg.cm 2 and 0.18 Kg.cm 2 ) in order to facilitate the emulation of other motors (see equation 6).

Figure 12 :

 12 Figure 12: Two motors assembly

IntelCore2Duo 2 .

 2 26 GHz processor, 2048 MB RAM and with an analog input and output I/O module 102 and EtherCAT interface. The real-time models were developed and uploaded on the target machine within the Matlab-Simulink simulation environment.



  Thermal time constant (motor housing to ambient)  Motor time constant (windings to housing)  Cogging torque effects  Dynamics of position control (not applicable here)  Dynamics of speed control  Electric time constant of the motor  Dynamics of torque control  Sampling  PWM switching

Table 1 :

 1 Summarizing some studies concerning HIL for electrically-driven pump

		drive + Motor emulating	Hydraulic Pump	To get more information about system performance at
		the hydraulic pump with PDEs		different working conditions
	This	High performance electric drive +	Virtual drive (supply, motor, and PDE) to	To test different electric motor technologies, observe
	paper	Real hydraulic pump	be used in the final product	limitation and give recommendations to get optimum
				electric drive

Acknowledgement

The present work has been funded by Region Occitanie and Fonds Unique Interministériel in the frame of the 18th project call n°15061455.


Sylvain Guilley

Annelie Heuser

Olivier Rioul

Codes for Side-Channel Attacks and Protections

published or not. The documents may come

Introduction

Digital information is handled by electronic devices, such as smartphones or servers. Some information, such as keys, is sensitive, in the sense that it shall remain confidential. In general, information is present in three states within devices: at rest, in transit, and in computation. The protection of information at rest can be ensured by on-chip encryption in the memories. The same technique applies to the data in transit: the buses can be encrypted (e.g., in a lightweight way, in which case one uses the term scrambling). Therefore, the protection of information during computation is the big issue to be dealt with. It is a real challenge, as a computing devices inadvertently leak some information about the data they manipulate. In this context, three questions are of interest:

1. How does an attacker best exploit the leaked information? The situation is similar to that of a decoding problem, and one aims at finding the optimal decoder. 2. Second, the designer (and the end user) aim at being protected against such attacks. Their goal is thus to try and weaken the side-channel. Randomization is one option, referred to as masking in the literature. We will illustrate that it can be seen as the use of code to optimally mix some random bits into the computations, with the possibility to eventually get rid off this entropy, e.g., at the end of the computation. Another interesting usage of codes is to detect faults in circuits. This dual use of codes is of interest in general security settings, where attacks can choose to be either passive or active. It is also very relevant in the case the circuit is trapped with a Hardware Trojan Horse. 3. Third, it is interesting to know in which respect the circuit leakage favors or not attacks. In particular, we will investigate the effect of glitches as a threat to masking schemes.

Outline. We start with the adversarial strategies in Sec. 2. Protection strategies, especially masking, are presented in Sec. 3. We will show how the circuit itself can contribute to the attack, through the analysis of glitches, in Sec. 4. Conclusions are in Sec. 5. Eventually, appendix A gives some computation evidences why masking protection can be seen as reducing the signal-to-noise ratio, by increasing the noise.

2 Side-channel Analysis as a Decoding Problem

In this section, we first describe the setup and the objective of the attacker. Second, we solve the objective of the attacker in various different setups.

Setup

We assume the device manipulates some data known by the attacker, such as a plaintext or a ciphertext, called T . This data is mixed with some secret, say a key k * . The attacker manages to capture some noisy function of T and k * , and attempts to extract k * . For this purpose, he will enumerate (manageable) parts of the key (e.g., bytes), denoted k, and choose the key candidate k which is the most likely. Therefore, the attack resembles a communication channel, where the input is k * and the output is k. The attack is termed successful if k =k * . Two kinds of leakage models are realistic in practice:

1. direct probing model, where the attacker uses some kind of probes, each being able to measure one bit, 2. indirect measurement of an aggregated function of the bits, using for instance an electromagnetic probe.

These two ways of capturing the signal are, by nature, very different. They are illustrated in Fig. 1. The first one is noiseless. However, the bits in integrated circuits are nanometric, whereas probes are mesometric. Therefore, only few such probes can be used simultaneously. The security parameter is thus linked to the ability for the attacker to recover some useful information out of d probes (where d is typically 1, 2, 3 or 4). Besides, the probing requires a physical access to the wires, which is challenging, since it is possible that the contact breaks the bit to be probed. Such attack is termed semi-invasive, since it leaves an evidence that the circuit has been tampered with (an opening is necessity to insert the probe).

The second one is noisy and also leaks some function of the bits. Therefore, the attacker needs to capture more than one trace to extract some information. This is why we model, in the sequel, traces by random variables. By convention, the variables are printed with capital letters, such as X, when designating a random variable, and with small letters, such as x, when designating the realization of random variables. We also denote by Q the number of queries (= of measurements), and by x=(x 1 ,...,x Q ) the vector of measurements. This attack will require a statistical analysis, which in general consists in the study of the leakage probability distribution. This starts in general by the analysis of the leakage moments.

We will link the two models in the case of RSM countermeasure (Sec. 3.5). The next section 2.2 discusses the channel k → k, for the second case.

Example of AWGN Channel

The key recovery setup is illustrated in Fig. 2 (see Fig. 1 in [START_REF] Heuser | Good Is Not Good Enough -Deriving Optimal Distinguishers from Communication Theory[END_REF]). When the noise is Gaussian and independent from one measurement to others, it is Fig. 2. Side-channel analysis as a communication channel referred to as AWGN (Additive white Gaussian noise). We write:

X =y(T,k * )+N,
where N ∼N (0,σ 2 ).

(

) 1
The random variable y(T,k * ) is the aggregated leakage model, and N is the noise (independent from Y ). Let n the bitwidth of the key k and of the texts T . The function y :F n 2 ×F n 2 →R is, in practice, the composition two functions y =ϕ•f, where:

f is an algorithmic function called sensitive variable, such as f(T,k * ) = S(T ⊕k * ), where S is a substitution box, and ϕ : F n 2 → R accounts for the way the sensitive variable leaks, such as the Hamming weight ϕ:z →w H (z)= n i=1 z i .

Absence of Countermeasures

The optimal distinguisher is the key guess k which maximizes the success probability, that is the probability that k is actually k * . When there is no protection, all the uncertainty resides in the measurement noise. Thus, as the attacker knows T , he also knows Y =Y (T,k) (for all key guess k).

Theorem 1 ([24, Thm. 4]). In the AWGN setup, the optimal distinguisher is demonstrated to be equal to:

D opt (x,t)=argmin k x-y(t,k) 2 2 =argmax k x|y(t,k) - 1 2 y(t,k) 2 2 , ( 2
)
where • 2 is the Euclidean norm and •|• is the canonical scalar product.

Multivariate and Multimodel Setting

In the multivariate and multimodel case, the attacker is able to collect:

not only one sample, but D (dimensionality) samples, and each function of the bits (e.g., z → 1, z → z i for 1 ≤ i ≤ n, but also any selection of z → i∈I z i where I ⊆F n 2 ) has a different contribution. We call S the number of models, and α the D×S matrix of the leakages, such that Eqn. ( 1) is generalized as:

X=αy(T,k * )+N,
where N∼N (0,Σ),

where We have a generalization of Theorem 1:

N
Theorem 2 ([7, Thm. 1]). Let us define x = Σ -1/2 x and α = Σ -1/2 α.
Then, in the multivariate and multimodel AWGN setup, the optimal distinguisher is demonstrated to be equal to:

D D,S opt (x,t)=argmin k D d=1 x d -α d y((t,k) 2 2 =argmax k tr x α y(t,k) T - 1 2 α y(t,k) 2 F ,
where tr(•) is the trace operator of a square matrix and • F is the Frobenius normal of a (rectangular) matrix.

Collision

In some situations, the attacker does not know the leakage function y =ϕ•f, but knows that it is reused several times for different bytes, say L > 1. We denote by x (•) = (x (1) ,...,x ( ) ,...,x (L) ) the L leakages. Therefore, the optimal attack consists in a collision attack where all the coefficients of the leakage function are regressed.

Theorem 3 ([5, Thm. 2.5]). The optimal collision attack is:

D L opt (x (•) ,t (•) )=argmax k (•) ∈(F n 2 ) L u∈F n 2 q/t ( ) q ⊕k ( ) =u x ( ) q 2 q/t ( ) q ⊕k ( ) =u 1 .
Notice that in general, this attack allows to recover (L-1) n-bit keys when the collision is involving L samples with identical leakage model.

General Setting with Countermeasures

In general, the device defends itself, by the implementation of protections. Masking (cf. Sec. 3.2) is one of them. In the expression of y, in addition to T and k, another random variable M is introduced, called the mask, unknown to the attacker. It is usually assumed that it is uniformly distributed.

Theorem 4 ([8, Proposition 8]). The optimal attack in case of masking countermeasure is:

D M;L opt (x (•) ,t (•) )=argmax k Q q=1 log m exp D d=1 1 σ (d) 2 x (d) q y (d) q - 1 2 y (d) q 2 ,
assuming that the noise at each sample d is normal of variance σ (d) 2 .

Link Between Success Probability, SNR and Leakage Function

The optimal distinguishers D opt given in various scenarios (D opt for nominal case in Sec. 2.3, D D,S opt for multivariate and multimodel case in Sec. 2.3, D L opt for the collision case in Sec. 2.5, and D M;L opt for the masked case in Sec. 2.6) allow to recover the secret key with the largest success rate (denoted as SR), but do not help in predicting the number of traces to reach a given success rate (or vice-versa).

Such relationship can be easily derived from the analysis of so-called firstorder exponents [START_REF] Sylvain Guilley | A Key to Success -Success Exponents for Side-Channel Distinguishers[END_REF]. Let us denote A opt (x,t,k) the argument of maximization in either of D opt , D D,S opt , D L opt or D M;L opt . We have: Theorem 5 ([23, Corollary 1]).

1-SR(D)≈e

-Q•SE(D) (4)
where the first-order success exponent SE(D) is equal to:

SE(D)= 1 2 min k =k * A opt (x,t,k * )-A opt (x,t,k) 2 Var A opt (x,t,k * )-A opt (x,t,k) . ( 5
)
For the sake of the introduction of a signal-to-noise, we rewrite Eqn. (1) as:

X =αy(T,k * )+N, where E(y(T,k * ))=0, Var(y(T,k * ))=1 and N ∼N (0,σ 2 ).

Let us introduce generalized confusion coefficients [20]:

Definition 6 (General 2-way confusion coefficients [START_REF] Sylvain Guilley | A Key to Success -Success Exponents for Side-Channel Distinguishers[END_REF]Def. 8 & 10]).

For k =k * we define

κ(k * ,k)=E Y (k * )-Y (k) 2 2 , (6)
κ (k * ,k)=E Y (k * )-Y (k) 2 4 . (7)
For example, for the optimal distinguisher in the nominal case, the success exponent expression is:

Lemma 7 (SE for the optimal distinguisher, [23, Proposition 5]). The success exponent for the optimal distinguisher takes the closed-form expression

SE(D opt )= 1 2 min k =k * α 2 κ 2 (k * ,k) σ 2 κ(k * ,k)+α 2 (κ (k * ,k)-κ(k * ,k) 2 . ( 8
)
This closed-form expression simplifies for high noise σ α in a simple equation:

Corollary 8 ([23, Corollary 2]
). For low SNR:

SE(D opt ) ≈ 1 2 min k =k * α 2 κ 2 (k * ,k) σ 2 κ(k * ,k) = 1 2 •SNR• min k =k * κ(k * ,k), (9)
where SNR = α 2 /σ 2 is the signal-to-noise ratio (see [START_REF] Bruneau | Less is More -Dimensionality Reduction from a Theoretical Perspective[END_REF] for the definition of SNR in the multivariate case).

Side-Channel Protection

Side-channel attacks threaten the security of cryptographic implementations. Protections against such attacks can be devised using the coding theory. We illustrate in this section several techniques which randomize leakages in a view to decorrelate them from the internally manipulated data, and that (in some cases) also allow to detect malicious fault injections.

Strategies to Thwart Side-Channel Attacks

As discussed in Sec. 2.7 (especially in ( 9)), the success of an attack is all the larger as the leakage function has a higher confusion ( 6) and the SNR is high. However, the input of confusion is limited, since 0≤min k =k * κ(k * ,k)≤1/2 is bounded. Moreover, the defender cannot always change the algorithm nor its leakage model, that is min k =k * κ(k * ,k) is fixed. Thus, the defender is better off focusing on the reduction of the SNR. This can be achieved in two flavors:

1. reduce the signal, as done in strategies aiming at flattening the leakage. This is easily achieved for some side-channels, such as timing: the execution time is made constant, e.g., by inserting dummy instructions or by balancing the code in each branch when the control flow forks. However, balancing an analogue quantity (such as power or electromagnetic field) is more challenging, let alone because of process variations, two identical gates or structures behave differently after fabrication. For instance, this is the working factor of physically unclonable functions (PUFs). Therefore, the quality of the protection depends on the ability of the fabrication plant to produce reproducible patterns. This fact naturally limits the quality of the designer's work, hence does not encourage to reach very high levels of security. In case this case, the second option is preferred; 2. increase the noise, by resorting to some extra random variables independant of that involved in the leakage function. Obviously, some artificial noise can be easily produced: one practical example consists in running an algorithm known to produce a lot of leakage (such as an asymmetrical engine, e.g., RSA) in parallel to the algorithm to protect. However, there remains the risk that the attacker manages, by a subtle placement of the probes, to limit or completely avoid the externally added noise; imagine an attacker with a very selective electromagnetic probe which would place its probe over the targetted algorithm, which is micrometers apart from the noise source (RSA). Therefore, it sounds wiser to entangle the computation and the random variables. This is what is achieved by so-called masking schemes. Appendix A explains why masking reduces the SNR.

Notice that the two strategies are orthogonal, that is, it is beneficial to employ them at the same time. Still, in the sequel, we will focus on masking, since it allows (at least in theory) to increase the noise at the maximal extent.

Masking Schemes

Masking schemes have been introduced to obfuscate the internals of a computation, in a view to make it more difficult to be attacked. The strategy in masking is based on randomization:

for data (e.g., in algorithms with constant-execution flow, such as AES), and for operations (e.g., in algorithms where the sequence of operations leak some secrets, such as RSA).

In practice, a masking scheme consists in four algorithms, as depicted in Fig. 3. Initially, the input data must be masked, thanks to a first algorithm. Second, the masked data is manipulated, so as to implement the intended cryptographic new larger look-up tables, where the masking material is now part of the addressing strategy, table recomputation specifically for the current mask, or computation style which is able to operate on masked data.

After the operation has been computed, it can be necessary to refresh the masks. Indeed, if the value is intended to be used more than once, then some masks would be duplicated during the computation. It is thus wise to re-randomize the current masks. Eventually, at the end of the computation, the masked data shall be freed from its mask. Hence a demasking step. The first three algorithms require entropy, whereas the last one destroys entropy.

Security of Masking Schemes

It is easy to measure the amount of entropy consumed by a masking scheme (see top of Fig. 3). However, this does not obviously reflect its actual security level. Indeed, the entropy can be wasted, e.g., by being badly used: XORing together entropy reduces it, while bringing no additional difficulty for the attacker.

The first attempt to measure security arise from [1, Definition 1]. The order is defined as the minimum number of intermediate values an attacker must collect to recover part of the secret. In this framework, the overall security is that of the weakest link.

Still, the exact definition of an intermediate variable is unclear. The difficulty arises from the fact the designer would like to link the security to properties of its design. However, the intermediate variables encompass different notions depending on the refinement stage: after compilations, variables are mapped to internal resources. Thus, the granularity [1, §3] can change between the cryptographic algorithm specification, the source code, the machine code, and what is actually executed on the device. Some early works considered intermediate values are bits, such as in private circuits [START_REF] Ishai | Private Circuits: Securing Hardware against Probing Attacks[END_REF][START_REF] Ishai | Private Circuits II: Keeping Secrets in Tamperable Circuits[END_REF]. This makes sense for hardware circuits, for which (in general CMOS processes) an equipotential has only two licit values, that is carries one bit. However, private circuits have been extended to software implementations (see e.g. [START_REF] Rivain | Provably Secure Higher-Order Masking of AES[END_REF]), where intermediate variables become bitvectors of the machine word length. But after considering some new threats, such as glitches, a new trend has consisted in looking back to bit-oriented masking. This is typically the case of threshold implementations [START_REF] Nikova | Secure Hardware Implementation of Nonlinear Functions in the Presence of Glitches[END_REF], where the granularity is again the bit.

In this article, we are interested with the lowest possible level of security analysis, hence we consider that intermediate variables are bits.

Orthogonal Direct Sum Masking (ODSM): a Masking Scheme Based on Codes

We illustrate in this section several masking schemes, and show in which respect they relate to coding theory. We will show that the two security notions related to masking (probing and bounded-moment models) are equivalent when conducting analyses at bit-level. We model a circuit as a parallel composition of bits, seen as elements of F 2 . The exemple, when there are n wires in the circuit, we model the circuit state as an element of F n 2 , that is the Cartesian product F 2 ×...×F 2 . At this stage, we use the following new notations. Let X a k-bit information word to be concealed. Let Y an (nk)-bit mask used to protect X. The protected variable is Z =XG+Y H, where:

• G is an k×n generating matrix of a code, • H is an (n-k)×n generating matrix of a code of dual distance d+1, • + is the bitwise addition in F n 2 , sometimes also denoted by ⊕. The random variable Y H is the mask. In practice, the bits making up Z can be manipulated in whatever order, i.e., they can even be scheduled to be manipulated one after the other, like in a bitslice implementation. We call Z an encoding with codes, or ODSM [3].

Then, we have the following twain theorems.

Theorem 9. Encoding with codes is secure against probing of order d.

Proof. By definition of a code of dual distance d+1, any tuple of less than d coordinates is uniformly distributed [START_REF] Carlet | Boolean Functions for Cryptography and Error Correcting Codes: Chapter of the monography Boolean Models and Methods in Mathematics[END_REF]. Thus, if the attacker probes up to d (inclusive) wires, this word seen as an element of F d 2 is perfectly masked. Therefore, no information on X can be recovered.

Theorem 10 (Masking with codes is d-th order secure in the boundedmoments model). For all pseudo-Boolean function ψ : F n 2 → R (leakage function, denoted y =ϕ•f in Sec. 2.2) of degree d • (ψ)≤d, we have

Var(E(ψ(XG+Y H|X)))=0. (10)
Proof. Let ψ the indicator of the code generated by H. Since H has dualdistance d+1, we have that for all z ∈ F n 2 , 0 < w H (z) ≤ d, ψ (z) = 0, where ψ (z) = z ∈F n 2 ψ (z)(-1) z •z . Now, owing to Lemma 1 in [4], we also know that for all z ∈F n 2 , w H (z)>d • (ψ), ψ(z)=0. Now, we must prove that Var(E(ψ(XG+Y H|X)))=0, that for all x∈F k 2 ,

y∈F n-k 2 ψ(xG + yH) = z∈F n 2 ψ(xG + z)ψ (z) = (ψ ⊗ ψ )(xG)
is the same, where ⊗ is the convolution product.

Actually, we can prove more than that, namely that ψ⊗ψ is constant on the full F n 2 . This is equivalent to proving that ψ⊗ψ = ψ ψ is equal to zero on F n 2 \{0}. Indeed, let z ∈F n 2 , z =0. If w H (z)>d • (ψ), then ψ(z)=0. And if w H (z)≤d • (ψ)≤d, then ψ (z)=0. So, in both cases, we have ψ(z) ψ (z)=0.

Notice that the function ψ :F n 2 →R such that ψ(x)= n-1 i=0 x i 2 i , has degree one. It is sometimes (abusively) referred to as the identity function. Obviously, if the attacker gets to know ψ(Z), then he can recover Z, hence deduce X by projection on subspace vector C. But this is not our security hypothesis. Our result from Theorem 10 (and in particular its Eqn. [START_REF] Carlet | Correlation-Immune Boolean Functions for Leakage Squeezing and Rotating S-Box Masking against Side Channel Attacks[END_REF]) is that the inter-class variance of ψ(Z) knowing X is equal to zero, for all d • (ψ)≤d.

In Equation [START_REF] Carlet | Correlation-Immune Boolean Functions for Leakage Squeezing and Rotating S-Box Masking against Side Channel Attacks[END_REF], the degree of function ψ can be accounted by two reasons:

1. High-degree leakage in y = ϕ•f, arising from spurious physical interactions within the circuit, and occurring before a leakage can be observed outside of the circuit boundary. Such high-degree leakage can be caused by glitches (see Sec. 4), capacitive coupling such as cross-talk, IR drop, ground/substrate coupling, etc. (refer to [START_REF] Danger | Analyzing Security Breaches of Countermeasures Throughout the Refinement Process in Hardware Design Flow[END_REF]Sec. 4.2]); 2. Intentional combination function computed by the attacker, which can be: multivariate (which involves a product of several shares), or monovariate (raising to a given power, hence necessarily high-order zero-offset [START_REF] Waddle | Towards Efficient Second-Order Power Analysis[END_REF]).

As another remark, we notice that, although it is not strictly mandatory, the randomized variable Z can be manipulated by subwords, a bit like for classical masking, where the subwords coincide with shares. Let us give the example of the look-up table, in the case k =8 and n=16. We know that we can reach 4-th order security [4]. But we can decide not to manipulate only Z as such, but to cut it into two parts, Z =(Z H ,Z L ), where Z H ,Z L ∈ F 8 2 . This cut is motivated by the adequation between the masking scheme and the machine architecture, where maybe the basic register size is 8 bits. Then, we also cut the T-table(s) into two tables, namely T H and T L , both of 256 bytes. The algorithm 1 allows to evaluate the T-table using bytes only, i.e., without placing Z H and Z L side-by-side for all data Z.

Input :

-(zH,zL)∈F

for l =0 to 2 8 -1 do 4 z H ←z H ⊕TH[h×2 8 +l]∧(h=zH)∧(l =zL) 5 z L ←z L ⊕TL[h×2 8 +l]∧(h=zH)∧(l =zL) 6 end 7 end 8 return (z H ,z L )
Algorithm 1: S-box evaluation by block, without ever using a 16-bit word

Illustration for Some Coding-Based Masking Schemes

In the previous section, we have shown with Theorems 9 and 10 that the two models (bit-level probing and bounded moments) are equivalent, which motivates to consider the probing model at bit level (as opposed to at word level, as done in many papers (to cite a few: [START_REF] Coron | Higher Order Masking of Look-Up Tables[END_REF][START_REF] Duc | Making masking security proofs concrete -or how to evaluate the security of any leaking device[END_REF]). We give hereafter some examples of masking with codes at bit-level.

Perfect masking

The masks M 1 , M 2 , etc. are chosen uniformly in F k 2 . We assume here that k|n. It is possible to see perfect masking as a special case of ODSM [3], where:

G= I k 0 0 ... 0 and H =      I k I k 0 ... 0 I k 0 I k ... 0 . . . 0 0 . . . 0 I k 0 0 ... I k      . ( 11
)
Rotating Substitution-box Masking (RSM [START_REF] Nassar | RSM: a Small and Fast Countermeasure for AES, Secure against First-and Second-order Zero-Offset SCAs[END_REF]) Let us illustrate RSM on n=8 bits. The mask M is chosen uniformly in:

the set C 0 ={0x00} for no resistance, the set C 1 ={0x00,0xff} for resistance to first-order attacks, the set C 2 , a non-linear code of length 8, size 12 and dual distance d ⊥ C 2 =3, the set C 3 , a linear code of length 8, dimension 4 and dual distance d ⊥ C 3 =4. This code is fully described in [15]. It is a self-dual code of parameters [START_REF] Bruneau | Masks Will Fall Off -Higher-Order Optimal Distinguishers[END_REF]4,4].

The case C 3 is interesting since there are sixteen masks, hence (in hardware), the sixteen Substitution-boxes (S) of an algorithm such as AES can be implemented masked. When ϕ = w H and Z = f(T,k * ) = S(T ⊕k * ), then the leakage distributions X =ϕ(Z ⊕M) are represented in Fig. 4. RSM involves a random index, that is the choice of the initial codeword in C d , for a protection order of d. This choice can be done in a leak-free manner by using a one-hot representation. In the case of C 3 , sixteen such indices can be selected. The one-hot representation is given in Fig. 5. The random index is selected at random initially; then, from round to round, it is simply shifted.

F 8 2 =Z1 Z2 Z3, with |Z1|=16, |Z2|=128, |Z3|=112. = = = = = = = = Let z be the sensitive variable (z ∈ F n 2 , with n = 8) E[w 1 H (z ⊕ M )]: E[w 2 H (z ⊕ M )]: E[w 3 H (z ⊕ M )]: E[w 4 H (z ⊕ M )]:
0 8 0 0 8 8 z ∈ Z 1 z ∈ Z 2 z ∈ Z 3 Moments:
Leakage Squeezing (LS) In leakage squeezing, the shares are like for perfect masking, except that some bijective functions (linear or non-linear) are applied to them, thereby mixing bits better [START_REF] Danger | Protection des modules de cryptographie contre les attaques en observation d'ordre élevé sur les implémentations à base de masquage, 20 Janvier[END_REF][START_REF] Carlet | Leakage Squeezing of Order Two[END_REF][START_REF] Carlet | Correlation-Immune Boolean Functions for Leakage Squeezing and Rotating S-Box Masking against Side Channel Attacks[END_REF][START_REF] Carlet | Leakage squeezing: Optimal implementation and security evaluation[END_REF]. Results For the illustration of the bounded moment model, we use for our illustrations the Hamming weight leakage model. Notice that any other first-order leakage model would yield comparable results. Also, we illustrate the leakage based on two extreme plaintexts, that is 0x00 and 0xff. However, in some situations, these two plaintexts lead to the same leakage (e.g., for symmetry reasons).

In all the presented schemes, security holds only provided there is no highorder leakage. Said differently, it is possible to consider that there is a high-order leakage. For instance, in recap figure 6, the indicated security order is the attack total order. The total attack order is the sum of multiplicative contribution from the hardware and the operations carried out by the attacker. That is, poor hardware which couples bits contributes to facilitates attacks by combining bits.

Masking and Faults Detection

Codes are also suitable tools when both side-channel leakage must be masked and faults must be detected. This need is general in cryptography, and has specific applications when thwarting Hardware Trojan Horses (HTH) [START_REF] Ngo | Encoding the State of Integrated Circuits: A Proactive and Reactive Protection Against Hardware Trojans Horses[END_REF][START_REF] Ngo | Linear complementary dual code improvement to strengthen encoded circuit against hardware Trojan horses[END_REF][START_REF] Carlet | Optimized linear complementary codes implementation for hardware Trojan prevention[END_REF]. Indeed, the activation part of a HTH is impeded by masking, whereas the payload part is caught red-handed by a detection code.

Leakage Model and Glitches

The term glitch refers to a (some) non-functional transition(s) occurring in combinational logic. They exist because combinational gates are non-synchronizing, i.e., they evaluate as soon as one input arrive. In terms of hardware description languages (VHDL, Verilog, etc.), they are modelled as processes where all inputs belong to the sensitivity list. Thus, for the vast majority of gates with many inputs, there is the possibility of a race between the inputs. Therefore, some gates can evaluate several times within one clock period. Actually, the deeper the combinational gates, the more likely it is that:

there is a large timing difference between the inputs, thereby generating new glitches, and

1st 2nd 3rd 4th Z M 1 Z ⊕ M 1 Z ⊕ 2 i=1 M i Z ⊕ 3 i=1 M i M 1 M 1 M 2 M 2 M 3 Perfect masking z = 0x00 z = 0xff 1st 2nd 3rd 4th Z M ∼ U({0x00, 0xff}) Z ⊕ M Rotating Substitution-box Masking (RSM) z = 0x00 z = 0xff Z ⊕ M Z ⊕ M M ∼ U(C 2 ), with d ⊥ C2 = 3 M ∼ U(C 3 ), with d ⊥ C3 = 4 1st 2nd 3rd 4th Z Z ⊕ M Leakage Squeezing (LS) z = 0x00 z = 0xff Z ⊕ M Z ⊕ M F 1 (M ) F 2 (M )
F 3 (M )

F 1 = Id : z ∈ F 8 2 → z ∈ F 8 2
etc. continues up to order 6 . . . some input is already the output of a glitching gate, thereby amplifying the number of glitches.

It is known that glitches can defeat masking schemes [START_REF] Mangard | Successfully Attacking Masked AES Hardware Implementations[END_REF][START_REF] Mangard | Side-Channel Leakage of Masked CMOS Gates[END_REF][START_REF] Mangard | Pinpointing the Side-Channel Leakage of Masked AES Hardware Implementations[END_REF]. Some masking schemes which somehow tolerate [START_REF] Fischer | Masking at Gate Level in the Presence of Glitches[END_REF][START_REF] Nikova | Secure Hardware Implementation of Nonlinear Functions in the Presence of Glitches[END_REF][START_REF] Prouff | Higher-Order Glitches Free Implementation of the AES Using Secure Multi-party Computation Protocols[END_REF][START_REF] Gomathisankaran | Glitch resistant private circuits design using HORNS[END_REF] or avoid glitches [START_REF] Kuan | Overcoming glitches and dissipation timing skews in design of dpa-resistant cryptographic hardware[END_REF][START_REF] Moradi | Glitch-free implementation of masking in modern fpgas[END_REF] have been put forward. However, the real negative effect of glitches on security is usually perceived in a qualitative manner. Therefore, we would like to account quantitatively for the effect of glitches. Let us start by an illustrative example 1 , provided in Fig. 7. The upper part of this figure represents a pipeline, where some combinational gates (AND gates represented by and XOR gate represented by ) form a partial netlist between two barriers of flip-flops (DFF gates represented by ). For the sake 1 Leakage of combinational gates arises from their transitions, that is it actually depends both on their initial and final states. In order to make the two use-cases presented in Fig. 7 and 8 simple to understand, we initialize the netlists at an all-zero state, thence we can reason only on the final values.

of this explanation, all the gates are assumed to have the same propagation time, namely 1 ns. The lower part of this figure gives the chronograms of the execution of this netlist, when initially all signals are set to zero. It appears that, owing to the difference of paths between the two inputs of the final XOR gate, this gate generates a glitch, highlighted with symbol , which lasts 3 ns, between time 1 and 4 ns within the depicted clock period. The condition for this glitch to appear is the following: x 1 ∧x 2 ∧x 3 ∧x 4 . This means that this glitch is a 4th-order leakage. So, if the masking scheme is only 3rd-order resistant, the setup of Fig. 7 would generate a glitch which compromises the security in a 1st-order side-channel attack. That is, the circuit itself contributes to the attack, in combining the bits on behalf of the attacker. Assume now a setup slightly more simple than that of Fig. 7, where there is only one AND gate behind the second input of the XOR gate. However, we assume such pattern is present twice, once computing y 0 =x 0 ⊕(x 1 ∧x 2 ), and another time computing y 5 =x 5 ⊕(x 4 ∧x 3 ). Then, in this case depicted in Fig. 8, the leakage incurred by the glitches at the output of the XOR gates would only combine two bits amongst the x i (namely x 1 & x 2 , and x 3 & x 4 ). Therefore, it suffices for the attacker to conduct a 2nd-order attack on the glitchy traces to succeed a 2×2=4th order attack on the masking scheme. The circuit and the attacker collaborate in the objective of realizing a 4th-order attack: half of the combination is carried out by the circuit ((x 1 ∧x 2 ) and (x 3 ∧x 4 )), while the other half is left remaining to the attacker. Indeed, by raising the traces to the second power, the attacker obtains a term (x 1 ∧x 2 )×(x 3 ∧x 4 ), which coincides with the leakage condition of Fig. 7, that is i=4 i=1 x i . To conclude on the leakage model complexification, we underline that it has a negative impact on two situations:

on low-entropy masking schemes, where the individual shares are not protected at the maximum order (see for instance RSM in Sec. 3.5), and on any masking schemes, where shares interact between themselves by some combinational logic.

In those two cases, a great care must be taken; tools as that described in [START_REF] Danger | Analyzing Security Breaches of Countermeasures Throughout the Refinement Process in Hardware Design Flow[END_REF] can help check the design is secure (or not).

Conclusion

Throughout this paper, we have seen how coding and side-channel analysis can benefit one from another, for attack as well as for protection. This is a nice example of cross fertilization between disciplines, in which Claude Carlet played a decisive role. Thanks to you, Claude! -Y 1 and Y 2 are leakage functions (assumed normalized, that is E(Y i )=0 and Var(Y i )=1, for i∈{1,2}).

In the Boolean masking where the attacker target the pair (mask, masked substitution box S), the leakage model is: The notation M b means bit b∈{1,...,n} in bitvector M ∈F n 2 . As the masking is first-order perfect, we indeed have that E(Y i |T =t) does not depend on the key, for each share i∈{1,2}. However, the attacker is inclined to combine the two leakages by a centered product, since the expectation of this combination Y c =Y 1 Y 2 depends on the key, despite the masking with the uniform M ∼U(F n 2 ). Precisely, let t∈F n 2 one realization of T . We have that: (-1) S b (T ⊕k) (because m is uniform on

-Y 1 = 2
E(Y c |T =t)= 1 2 n m∈F n
F n 2 ) =- 1 2 √ n w H (S(T ⊕k))- n 2 , (12)
which happens to be proportional to the leakage model of the substitution box when the masking is disabled (M =0). Indeed, one can derive from Eqn. [START_REF] Carlet | Leakage Squeezing of Order Two[END_REF] that:

E(Y c |T =t)=- 1 2 √ n E(Y 1 |T =t,M =0).
The second-order attack thus consists in applying the regular correlation power analysis (CPA [START_REF] Brier | Correlation power analysis with a leakage model[END_REF]):

targeting X c =X 1 X 2 instead of X 1 or X 2 , using as leakage model E(Y c |T ), where we recall that Y c =Y 1 Y 2 [START_REF] Prouff | Statistical Analysis of Second Order Differential Power Analysis[END_REF].

Thus, the new leakage to analyse is:

X c =X 1 X 2 =(α 1 Y 1 +N 1 )(α 2 Y 2 +N 2 ) =α 1 α 2 Y 1 Y 2 signal +α 1 Y 1 N 2 +α 2 Y 2 N 1 +N 1 N 2 noise .
Indeed, the term Y 1 Y 2 conditionally to the known plaintext T depends on the key (recall Eqn. ( 12)), whereas the other terms α 1 Y 1 N 2 +α 2 Y 2 N 1 +N 1 N 2 do not.

Therefore, the SNR in the case of the second-order attack is:

SNR(2o)= Var(α 1 α 2 Y 1 Y 2 ) Var(α 1 Y 1 N 2 +α 2 Y 2 N 1 +N 1 N 2 ) . ( 13
)
Proposition 11. The SNR in the case of the second-order attack is:

SNR(2o)= SNR 1 •SNR 2 1+SNR 1 +SNR 2 ,
where SNR i =α 2 i /σ 2 i for i∈{1,2}.

Proof. We have:

E T,M (Y 1 Y 2 )= 1 2 2n t∈F n 2 ,m∈F n 2 Y 1 Y 2 = 1 2 2n 2 √ n 2 m w H (m)- n 2 t w H (S(t⊕k )⊕m)- n 2 = 1 2 2n 2 √ n 2 m w H (m)- n 2 z w H (z)- n 2 (14)
=0×0=0.

At line [START_REF] Carlet | Side-Channel Indistinguishability[END_REF], we used the fact that S is a bijection of F n 2 (as is SubBytes in AES [START_REF]Advanced Encryption Standard (AES)[END_REF]).

Besides, we also have: Therefore, the variance of the signal is equal to α 2 1 α 2 2 . Regarding the noise part, we have:

E T,M (Y 1 Y 2 ) 2 =
E(α 1 Y 1 N 2 +α 2 Y 2 N 1 +N 1 N 2 )=0,

Fig. 1 .

 1 Fig. 1. Settings for side-channel analysis. In the probing model (a), a few bits (here, d=3) are measured with dedicated probes. In the bounded moments model (b), the attacker measures an integrated quantity of several bits.

Fig. 3 .

 3 Fig. 3. Masking schemes

Fig. 4 .

 4 Fig. 4. Leakage distribution of RSM using M ∼U(C3) on n=8 bits

Fig. 5 .

 5 Fig. 5. Example of one-hot counter (out of 16), used to designate the round index position

Fig. 6 .

 6 Fig. 6. Security level of several masking schemes. The order d=1,2,3,4 corresponds both to the number of probes (see Fig. 1(a)) used by the attacker and to the moment of leakage when the attacker uses an integrating probe (see Fig. 1(b))

Fig. 7 .

 7 Fig. 7. Example of 4th-order glitch occurring upon 4th-order conjunction i=4 i=1 xi

  Fig. 8. Example of two 2nd-order glitches occurring upon 2th-order conjunctions i=2 i=1 xi and i=4 i=3 xi

√- 1 √ n n b=1 (- 1 ) 2 √ 1 )

 1121 n w H (S(T ⊕k)⊕M)-n 2 =S b (T ⊕k)⊕M b and -Y 2 = M b .

2 1

 2 n b,b (-1) S b (T ⊕k)⊕m b ⊕m b

  is multivariate normal of D×D covariance matrix Σ, and Y =y(T,k * ) is set of S models (e.g., S = 1 if the leakage model is the Hamming weight, or S =n+1 if there is a non-zero offset (such offset is modeled by z →1) and each bit 1 ≤ i ≤ n of the leakage model leaks differently). In this case also, boldface variables are vectorial (either multivariate or multimodel).

-

  TH,TL, two tables of size 2 16 bytes Output : The result of the lookup (TH[zH ×2 8 +zL],TL[zH ×2 8 +zL]) 1 Initialize z H ∈F 8 2 and z L ∈F 8 2 to zero 2 for h=0 to 2 8 -1 do

	8 2 ×F 8 2
	3

  8. Example of two 2nd-order glitches occurring upon 2th-order conjunctions i=2 i=1 xi and i=4 i=3 xi 3. Julien Bringer, Claude Carlet, Hervé Chabanne, Sylvain Guilley, and Houssem Maghrebi. Orthogonal Direct Sum Masking -A Smartcard Friendly Computation Paradigm in a Code, with Builtin Protection against Side-Channel and Fault Attacks. In WISTP, volume 8501 of LNCS, pages 40-56. Springer, June 2014. Heraklion, Greece. 4. Julien Bringer, Claude Carlet, Hervé Chabanne, Sylvain Guilley, and Houssem Maghrebi. Orthogonal Direct Sum Masking: A Smartcard Friendly Computation Paradigm in a Code, with Builtin Protection against Side-Channel and Fault Attacks. Cryptology ePrint Archive, Report 2014/665, 2014. http://eprint.iacr.org/2014/665/ (extended version of conference paper [3]). 5. Nicolas Bruneau, Claude Carlet, Sylvain Guilley, Annelie Heuser, Emmanuel Prouff, and Olivier Rioul. Stochastic collision attack. IEEE Trans. Information Forensics and Security, 12(9):2090-2104, 2017.

  =1×1=1(as per the normalization of Y 1 and Y 2 ).

		1 2 2n	t∈F n 2 ,m∈F n 2	(Y 1 ) 2 (Y 2 ) 2
	=	1 2 2n	2 √ n	4	m	w H (m)-	n 2	2	t	w H (S(t⊕k )⊕m)-	2 n	2
	=	1 2 2n	2 √ n	4	m	w H (m)-	n 2	2	z	w H (z)-	n 2	2	(15)

Acknowledgements

Part of this work has been funded by the ANR CHIST-ERA project SECODE (Secure Codes to thwart Cyber-physical Attacks).

A SNR in the Presence of First-Order Masking

Let us consider a first-order masking scheme [START_REF] Blömer | Provably Secure Masking of AES[END_REF]. By design, a first-order sidechannel attack fails. However, a second-order side-channel attack, combining two samples, can succeed. The setup is the following: the leakage is:

where:

-N 1 ∼N (0,σ 2 1 ) and N 2 ∼N (0,σ 2 2 ) are two independent noise sources, α 1 and α 2 are the amount of leakage, by independence between N 1 , N 2 and Y i for i∈{1,2}. We also have:

As a result, we have:

Corollary 12 (Limit of SNR(2o) in the presence of large noise). When the noise is large, that is SNR i 1 for i∈{1,2}, then

Proof. Immediate first-order simplification of SNR(2o) as given in Proposition 11.