Search

The emergence of cyber-physical systems (CPS) and internet of things (IoT) devices impose significant security and privacy concerns that necessitate robust monitoring and malware detection systems. This paper proposes PITEM, a framework for instruction-level monitoring and malware detection using electromagnetic (EM) side-channels. PITEM identifies instruction types with similar EM emanations using hierarchical clustering. To track all combinations of these instruction types, we generate EM signatures for all permutations of them. In testing, we predict the permutation class of testing traces by a matched-filter-like predictor. We test the performance on two devices (FPGA-based and ARM-based) with 50 MHz and 1 GHz clock frequencies. We achieve 95.67% and 87.35% accuracies for these devices for single execution of permutations. We note that the accuracy increases to 100% when permutation blocks are repeated. Furthermore, we test the limits of the system by tracking permutations of instructions of the same type. With sufficient bandwidth and number of repetitions, individual instructions can be resolved with 87.5% and 95.78% accuracies for these devices. The performance is evaluated for different relative signal-to-noise ratio (SNR) levels and performance is stable for relative SNR values > 15 dB. Finally, we demonstrate PITEMs ability to detect fine-grained malware with 99.89% accuracy.

The ubiquitous interconnectivity of electronic devices offered by Internet-of-Things (IoT) networks has been increasingly embraced in a wide range of applications. In IoT networks, threats to hardware security are often not perceived as serious, with the assumption that an attack could only be carried out at close proximity. However, in this article, we show that through electromagnetic (EM) side-channel signal leakage, operational information and program activities of IoT devices and field-programmable gate array (FPGA) modules can be garnered from approximately 200 m away in an outdoor line-of-sight (LOS) environment. We describe an extensive measurement campaign conducted to investigate the aforementioned leakage and provide propagation models that can be used to predict the power (and corresponding variation i.e., shadowing gain) of the EM side-channel signal emanation at various distances, scenarios, and environments. With a circularly polarized receiver antenna, our results show that the received power of the emanated EM side-channel (carrier) signal varies from about −61 dBm at 1 m to about −112 dBm at 200 m in the outdoor LOS environment. Furthermore, a received signal power of about −73 dBm was observed at 1 m and −88 dBm was recorded at 10 m in an indoor LOS environment. Power variation (shadowing gain) of about 3.6 and 2.0 dB was observed in the outdoor and indoor environments, respectively. This work is relevant for EM side-channel leakage countermeasure development and provides pertinent information to embedded systems and wireless network security engineers.

This article proposes leveraging EM side-channels to recognize/authenticate electronic components integrated onto a motherboard. By focusing on components on a motherboard, our method provides an opportunity to authenticate devices assembled by third parties. This method identifies components based on the modulated signals emanated while they are excited in a controlled manner. When testing an unknown component, the spectrum is compared to previously recorded training signatures. To improve efficiency, the size of the spectrum is reduced by projecting it into a vector space generated from training signatures. The identity of the tested component is then determined using a k-nearest neighbors algorithm. This method successfully classified memory, processor, and Ethernet transceiver components integrated on seven types of Internet-of-Things devices. Since manufacturers commonly use the same components in multiple designs, cross-type testing of motherboards is conducted. Collecting the training signatures on one motherboard and testing components from different motherboards speeds up the process and decreases the cost. Using measurements taken while exciting the components for 1 s, our method achieves a classification accuracy greater than 96 $\%$ across all components tested. These results demonstrate that this method can recognize components based on their emanations, even if the components are integrated onto completely different motherboards.

This article presents a circuit impedance model and results of propagation characterization at 26.5 GHz and 300 GHz for a new type of RFID tag that is based on digital electronics. This RFID tag leverages the backscatter radio generated from switching of transistors inside digital circuits, which does not need antennas or RF front-end circuits thereby further reducing the device’s form factor. Moreover, the proposed RFID tag is compatible with a wide range of interrogating frequencies and can be implemented on existing electronics without additional cost. The proposed circuit impedance model explains the modulation mechanism of this new backscatter radio and provides an estimation of digital circuits’ impedance using SPICE model parameters. Based on the proposed circuit impedance model, we develop a modified modulation loss factor to estimate the modulation loss resulting from the switching activity of the digital electronics. Furthermore, propagation characterization is conducted at 26.5 GHz and 300 GHz, where the shadowing gain for the carrier power and the backscattered power is characterized as 3.93 dB and 0.96 dB at 26.5 GHz, and 1.01 dB and 0.52 dB at 300 GHz, respectively, showing that the backscatter channel can provide a more reliable link that is resistant to the constructive and destructive interference from the multipaths as compared to the carrier channel.

This article presents the near-field measurement setup and the sensor topology used to measure the backscattered signal from a small spot of $\sim 1$ mm on an FPGA to enable hardware Trojan (HT) detection. The novel sensor topology used in the setup contains a combination of $E$ - and $H$ -field probes with a tip diameter of 0.2 mm, which is used to excite a carrier and receive the modulated scattered signal that carries a signature of the inspected logic circuit. As a proof of concept and to develop insight, an EM-circuit co-simulation is presented to show that the received signal contains a signature of the logic circuit under test, which is imprinted on the relative power levels of the modulated scattered clock harmonics. The received modulated scattering signature was successfully used to detect the presence of an HT in the original circuit with 100% accuracy without false positives. The effects of using $E$ - and $H$ -field probes in very close proximity, such as resolution and mutual coupling, are analyzed and discussed. It is shown that there is a 12% decrease in resolution and less than 0.01 dB impact on invasiveness. The frequency band of operation for the measurement setup is 3–5 GHz. The probe combination is shown to have a spot size of ~1 mm, a coupling isolation better than 20 dB over the whole band and 30 dB for the design frequency.

This paper proposes a two dimensional (2-D) statistical channel model for Terahertz (THz) chip-to-chip wireless communication in desktop size metal enclosures. This model differs from traditional statistical channel models as it models both traveling and resonant waves that exist inside metal enclosures. Based on the cavity environment and the statistical properties of the channel inside the metal cavity, the geometrical model which describes propagation in resonant cavity as a superposition of LoS, single bounced (SB), double bounced (DB), and multi-bounced (MB) rays is proposed. Based on the geometrical model, a parametric reference model is proposed. Furthermore, the path loss model that captures signal strength variation in a resonant cavity is proposed. Frequency correlation functions (FCF) and power delay profiles (PDP) for different possible chip-to-chip communication scenarios are derived and compared with the measured ones. The results show a good agreement between the simulated and measured statistics.

Side-channel analysis is a powerful tool from both an attacker’s and defender’s perspective. Understanding similarities and differences among types of side-channels is a necessary step in better utilization of side-channels. This paper addresses this problem by modeling and quantitatively comparing backscattering, electromagnetic (EM), and power side-channels and discusses the performance of these three side-channels for detecting software malware and hardware Trojans (HT). The results show that for larger changes in the signals, such as those caused by malware intrusions, all three side-channels perform similarly. However, when smaller changes need to be observed, such as those caused by HTs, the backscattering side-channel outperforms EM and power side-channels.

This article presents details about an extensive channel measurement campaign and subsequent statistical channel models for the characterization of 300 GHz channels for wireless rack-to-rack (R2R) and blade-to-blade (B2B) communications in a data center-like environment. Measurements were conducted in various scenarios such as R2R line-of-sight (LoS), R2R obstructed-LoS (OLoS), R2R reflected-non-LoS (RNLoS), R2R obstructed-RNLoS (ORNLoS), B2B RNLoS, B2B ORNLoS, and B2B LoS scenarios. In the aforementioned scenarios, we explored the impact of transmitter (Tx)/receiver (Rx) misalignment and obstructions such as cables, metal cabinets, and mesh structures on terahertz (THz) propagation, as well as feasibility of using existing metal objects as reflectors for NLoS links. For the R2R LoS scenario, an optical lens was used to extend the Tx-Rx separation distance. This led to a waveguide effect in the channels measured thereby resulting into a path loss exponent (PLE) of 1.48 with a shadowing gain of 0.7 dB. When obstructions of cables are present, ORNLoS link outperforms OLoS link with 2.5 dB lower shadowing gain and weaker multipath. Reflector in the RNLoS link has reflection coefficients very close to 1 for all incident angles. For the B2B scenario, a dual-reflector THz transceiver rack system is proposed to enable wireless links across vertically stacked servers and allow easy maintenance and repair of servers. The measured path loss closely follows the Friis values in the LoS link and in the RNLoS link with hollow vertical ground plane. When obstructions of cables are present, the ORNLoS link experiences 5–10 dB higher path loss and on average 0.25 GHz lower coherence bandwidth than the RNLoS link. The measured statistical channel properties show that the shadowing gain caused by cable clusters follows the log-normal distribution.

It has been shown that digital and/or analog characteristics of electronic devices during executing programs can create a side-channel which an attacker can exploit to extract sensitive information such as cryptographic keys. When the attacker modifies the software application to exfiltrate sensitive information through a channel, this channel is called a covert channel . In this paper, we model this covert channel as a communication channel and derive upper and lower capacity bounds. Because the covert channels are not designed to transmit information, they are exposed not only to the errors created by the transmission, but also by varying the execution time of computer activities, and/or by insertions from other activities such as interrupts, stalls, etc. Combining all of these effects, we propose to model the covert channel as an insertion channel where the transmitted sequence is a pulse amplitude modulated signal with random pulse positions. Utilizing this model, we derive capacity bounds of the covert channel with random insertion and substitution due to the noise and jitter errors, and propose a receiver design that can correctly detect the computer-activity-created signals. To illustrate the severity of leakages, we perform experiments with high clock speed devices at some distance. Further, the theoretical derivations are compared to empirical results, and show good agreement.

The side-channel leakage is a consequence of program execution in a computer processor, and understanding relationship between code execution and information leakage is a necessary step in estimating information leakage and its capacity limits. This paper proposes a methodology to relate program execution to electromagnetic side-channel emanations and estimates side-channel information capacity created by execution of series of instructions (e.g., a function, a procedure, or a program) in a processor. To model dependence among program instructions in a code, we propose to use Markov source model, which includes the dependencies among sequence of instructions as well as dependencies among instructions as they pass through a pipeline of the processor. The emitted electromagnetic (EM) signals during instruction executions are natural choice for the inputs into the model. To obtain the channel inputs for the proposed model, we derive a mathematical relationship between the emanated instruction signal power (ESP) and total emanated signal power while running a program. Then, we derive the leakage capacity of EM side channels created by execution of series of instructions in a processor. Finally, we provide experimental results to demonstrate that leakages could be severe and that a dedicated attacker could obtain important information.

This article presents characterization of terahertz (THz) wireless channel inside a desktop size metal enclosure with the consideration of several different scenarios. Measurements indicate that both traveling wave and resonating modes exist inside the metal enclosure. Measurements for line-of-sight (LoS) propagation inside the empty metal enclosure show that the path loss significantly changes as a function of the transceiver’s height. It is found that this variation is due the resonant modes, contribution to the received power. Reflected-non-LoS (RNLoS) measurements show that for the same distance, the difference between the mean path loss measured inside the metal box and in a free space is limited to 1 dB, with traveling wave dominating the channel. This indicates that reflectors can be used as wave-guiding objects in metal enclosures. Finally, obstructed-LoS (OLoS) path loss measurements with the parallel dual in-line memory modules (DIMMs) as obstructions show the constructive/destructive effect on the waves due to multipath introduced by the parallel-plate structures. Compared to the free space scenarios, multipath is introduced by the traveling wave bouncing back and forth between the transceiver sides of the cavity, which introduces stronger fluctuations in observed pathloss and reduces the coherence bandwidth of the channel.

In this paper, THz channel propagation characterization and modeling for a desktop environment is presented. Path loss and PDPs measured on the motherboard in both free-space and desktop resemble m...

We present the first side-channel attack on full-fledged smartphones that recovers the elliptic curve secret scalar from the electromagnetic signal that corresponds to a single scalar-by-point multiplication in current versions of Libgcrypt, OpenSSL, HACL* and curve25519-donna. To avoid leaking information via side channels, these implementations follow the recommendations of RFC 7748 and use a constant-time conditional swap operation. Our attack targets signal differences created by systematic changes in operand values during this conditional swap operation. We deploy the attack, using low-cost equipment (

This paper presents a spatio-temporal analysis of discrete and diffuse multipath components (or paths) present in a propagation channel at Terahertz (THz) frequencies. These paths were extracted using a high-resolution parameter extraction algorithm RIMAX - an iterative maximum likelihood algorithm. For our analysis, we used measurement data obtained from a THz (300–312 GHz) $4\times 4$ Multiple-Input-Multiple-Output (MIMO) measurements conducted in an obstructed Line-of-Sight (OLOS) scenario in a data center environment. We provide statistical model for parameters such as mean direction-of-departure (DOD), mean direction-of-arrival (DOA) and the relevant angular and delay spreads. We provided a closed-form model for the diffuse path propagation along with statistical models for relevant spatial and temporal parameters. We showed that diffuse paths contribute a moderate amount of energy (mean value of 12.7%) to the overall energy measured in the THz MIMO Channel. Results in this work is important to wireless system design and development at THz frequencies.

This paper presents the use of terahertz near-field focusing for backscatter side-channel detection. Near-field focusing is done by using a Cassegrain reflector configuration. The focuser is designed to produce the focused beam 28 cm away from the antenna aperture. The focusing is done in the near-field region by axially moving the subreflector from the focal point. It is observed that the subreflector position has to shift approximately 11 wavelengths along the axis to create the focus at the required location. The focused antenna gain is 46 dBi, while the 3 dB focus width and depth of the designed antenna is ~4 mm and 10 cm, respectively. It is found that the focal plane position is sensitive to the subreflector shifts and it is observed that 1 mm change in the subreflector position can shift the focal plane by ~2 cm. The simulations are compared with the measurement results of a fabricated prototype and good agreement is observed. The antenna is fabricated by using 3-D printing technology, which allows rapid prototyping. Finally, we have demonstrated the detection of backscatter side channel from the board placed at 28 cm away from the designed antenna. The received power level of the backscatter signal increases by 6 dB as compared to horn antenna.

We propose a novel malware detection system for critical embedded and cyber-physical systems (CPS). The system exploits electromagnetic (EM) side-channel signals from the device to detect malicious activity. During training, the system models EM emanations from an uncompromised device using a neural network. These EM patterns act as fingerprints for the normal program activity. Next, we continuously monitor the target device’s EM emanations. Any deviation in the device’s activity causes a variation in the EM fingerprint, which in turn violates the trained model, and is reported as an anomalous activity. The system can monitor the target device remotely (without any physical contact), and does not require any modification to the monitored system. We evaluate the system with different malware behavior (DDoS, ransomware, and code modification) on different applications using an Altera Nios-II soft-processor. Experimental evaluation reveals that our framework can detect DDoS and ransomware with 100% accuracy (AUC = 1.0), and stealthier code modification (which is roughly a 5 μ s long attack) with an AUC ≈ 0.99, from distances up to 3 m. In addition, we execute control-flow hijack, DDoS, and ransomware on different applications using an A13-OLinuXino—a Cortex A8 ARM processor single board computer with Debian Linux OS. Furthermore, we evaluate the practicality and the robustness of our system on a medical CPS, implemented using two different devices (TS-7250 and A13-OLinuXino), while executing control-flow hijack attack. Our evaluations show that our framework can detect these attacks with perfect accuracy.

This paper describes a new physical side channel, i.e., the backscattering side channel, created by transmitting a signal toward the integrated circuits (ICs), where the internal impedance changes caused by on-chip switching activity modulate the signal that is backscattered (reflected) from the IC. To demonstrate how this new side channel can be used to detect small changes in circuit impedances, we propose a new method for nondestructively detecting hardware Trojans (HTs) from outside the chip. We experimentally confirm, using measurements on one physical instance for training and nine other physical instances for testing, that the new side channel, when combined with an HT detection method, allows detection of a dormant HT in 100% of the HT-afflicted measurements for a number of different HTs while producing no false positives in HT-free measurements. Furthermore, additional experiments are conducted to compare the backscattering-based detection to one that uses the traditional EM-emanation-based side channel. These results show that backscattering-based detection outperforms the EM side channel, confirm that dormant HTs are much more difficult for detection than HTs that have been activated, and show how detection is affected by changing the HT’s size and physical location on the IC.

Existing analog-signal side-channels, such as EM emanations, are a consequence of current-flow changes that are dependent on activity inside electronic circuits. In this paper, we introduce a new class of side-channels that is a consequence of impedance changes in switching circuits, and we refer to it as an impedance-based side-channel . One example of such a side-channel is when digital logic activity causes incoming EM signals to be modulated as they are reflected (backscattered), at frequencies that depend on both the incoming EM signal and the circuit activity. This can cause EM interference or leakage of sensitive information, but it can also be leveraged for radio-frequency identification (RFID) tag design. In this paper, we first introduce a new class of side-channels that is a consequence of impedance differences in switching circuits, and we refer to it as an impedance-based side-channel . Then, we demonstrate that the impedance difference between transistor gates in the high-state and in the low-state changes the radar cross section and modulates the backscattered signal. Furthermore, we have investigated the possibility of implementing the proposed RFID on ASIC for signal enhancement. Finally, we propose a digital circuit that can be used as a semi-passive RFID tag. To illustrate the adaptability of the proposed RFID, we have designed a variety of RFID applications across carrier frequencies at 5.8 GHz, 17.46 GHz, and 26.5 GHz to demonstrate the flexible carrier frequency selection and bit configuration.

This paper proposes a path loss model and a geometry-based statistical model for Terahertz (THz) chip-to-chip wireless communication in nettop size metal enclosures. The proposed path loss model captures the attenuation of traveling wave and the gain of the electromagnetic horn in near-field region, also the resonant modes in the metal enclosure. The proposed geometric channel model describes the propagation of the traveling wave and the wave generated from the excited walls as a superposition of line of sight (LoS) and multi-bounced (MB) rays. Measurements for LoS propagation in near-field region have been performed in the indoor environment and in a nettop size empty metal enclosure. A good agreement between the measured and model predicted results has been observed, which proves the validity of the proposed models.

Over the past few years, malicious hardware modifications, a.k.a. hardware Trojans (HT), have emerged as a major security threat because integrated circuit (IC) companies have been fabricating chips at offshore foundries due to various factors including time-to-market, cost reduction demands, and the increased complexity of ICs. Among proposed hardware Trojan detection techniques, reverse engineering appears to be the most accurate and reliable one because it works for all circuits and Trojan types without a golden example of the chip. However, because reverse engineering is an extremely expensive, time-consuming, and destructive process, it is difficult to apply this technique for a large population of ICs in a real test environment. This paper proposes a novel golden-chip-free clustering method using backscattering side-channel to divide ICs into groups of Trojan-free and Trojan-infected boards. The technique requires no golden chip or a priori knowledge of the chip circuitry, and divides a large population of ICs into clusters based on how HTs (if existed) affect their backscattered signals. This significantly reduces the size of test vectors for reverse engineering based detection techniques, thus enables deployment of reverse engineering approaches to a large population of ICs in a real testing scenario. The results are collected on 100 different FPGA boards where boards are randomly chosen to be infected or not. The results show that we can cluster the boards with 100% accuracy and demonstrate that our technique can tolerate manufacturing variations among hardware instances to cluster all the boards accurately for 9 different dormant Trojan designs on 3 different benchmark circuits from Trusthub. We have also shown that we can detect dormant Trojan designs whose trigger size has shrunk to as small as 0.19% of the original circuit with 100% accuracy as well.

This paper studies the effects of the geometrical parameters of the rectangular metallic enclosure on the THz wireless link. Three rectangular conducting cavities of different sizes are fabricated and tested to explore the feasibility for THz wireless link. The dimensions of the boxes are selected to represent the physical sizes of the computer desktops. Measurements show that the mode interference and hence multipath depend upon the transverse dimensions of the cavity. Furthermore, for the same excitation, it is shown that due to the large value of the fractional frequency changes the smaller cavity has less path loss variation and reduced multipath.

We present results for comparison of gain of the optimal uniform and nonuniform helical antennas taking into the account conductor losses. Critical conductivities are observed, for the given operating frequency and the helix axial length. Above the critical conductivity, the gain of the nonuniform helical antennas with linearly varying geometrical parameters is up to 2 dB higher than the gain of the optimal uniform antennas. However, below the critical conductivity, the difference between the gain of the nonuniform and uniform helical antennas is reduced, and the gain of those antennas becomes comparable. Data for the normalized critical conductivities are presented.

This paper presents the parameters determination of a path loss model for THz chip-to-chip wireless communication in desktop size metal enclosures. To determine the parameters, gradient decent algorithm was applied to minimize the mean square error between the model and the experimental results. Measurements were performed and the obtained results match well with the model prediction.

As one of the fundamental approaches for code optimization and performance analysis, profiling software activities can provide information on the existence of malware, code execution problems, etc. In this paper, we propose a methodology to profile a system with no overhead. The approach leverages electromagnetic (EM) emanations while executing a program, and exploits its flow diagram by constructing a Markov model. The states of the model are considered as the heavily executed blocks (called hot paths) of the program, and the transition between any two states is possible only if there exists a branching operation which enables execution of corresponding states without any intermediate state. To identify the state of the program, we utilize a supervised learning method. To do so, we first collect signals for each state, extract features, and generate a dictionary. The features are considered as the activated frequencies when the program is executed. The assumption here is that there exists at least one unique frequency component that is only active for one unique state. Moreover, to degrade the e↵ect of interruptions and other signals emanated from other parts of the device, and to obtain signals with high Signal-to-Noise Ratio (SNR), we average the output of Short-Time Fourier Transform (STFT). After extracting features, we apply Principle Component Analysis (PCA) for dimension reduction which helps monitoring systems in real time. Finally, we describe experimental setup and show results to demonstrate that the proposed methodology can detect malware activity with high accuracy.

Over the past few years, globalization of the semiconductor supply chain has led companies to outsource much of the production cycle for integrated circuits (ICs). While outsourcing helps companies significantly reduce their cost and time-to-market, it also introduces concerns about the trustworthiness of an IC. One of the most serious problems is counterfeiting of ICs, which not only negatively impacts innovation and economic growth of the IC industry, but also creates serious threats and risks for systems that incorporate those counterfeit ICs. This paper proposes a novel method that uses the backscattering side-channel to cluster ICs such that counterfeits are separated from legitimate ICs. The backscattering side-channel, which has been introduced only recently, has been proven to outperform other side-channels in detecting hardware Trojan horses (HTs), i.e. ICs where additional logic gates (and connections to existing logic gates) have been added. In this work we use it to robustly separate ICs into legitimate and counterfeit ones, even when only layout or placement of the IC has changed, without any added logic or connections. We evalute our technique on a set of ten boards over six different counterfeit IC designs, and find that our technique tolerates manufacturing variations among different hardware instances, detecting counterfeit ICs with 100% accuracy and 0% false positives.

This paper proposes a path loss model for THz chip-to-chip wireless communication in desktop size metal enclosures with respect to transceivers positions. This path loss model accounts for the attenuation due to the signal spreading, resonant modes inside the cavity, and the radiation pattern of the antenna. Measurements were performed in LoS and 2-D and 3-D misalignment propagation scenarios. The model prediction shows a good agreement with measured results, which proves the validness of the model.

This paper presents results from an investigation into long-range detection and monitoring of Electromagnetic (EM) side-channel signals leaked from Internet-of-Things (IoT) and Field Programmable Gate Array (FPGA) devices. Our work shows that operational information and program activities of the IoT and FPGA modules can be garnered at distances excess of 25 m in an indoor Line-Of-Sight (LOS) environment, while at about 10 m in an indoor (through the wall) Non-Line-Of Sight (NLOS) scenario. We provide a propagation model that can be used to predict the received power (and corresponding variation i.e., shadowing gain) of leaked EM side-channel signals at various distances and scenarios. A standard benchmark program bitcount used in the performance evaluation of ARMbased microprocessors and a microbenchmark SAVAT running on an IoT device were detected and monitored remotely in our work.

In this paper, we present results from a Terahertz (THz) channel measurement campaign in a data center environment. We analyze propagation parameters, such as pathloss, shadowing gain, and RMS delay spread. Amplitude fading statistics in a 4 × 4 Multiple-Input-Multiple-Output (MIMO) channel are also investigated. Furthermore, Doppler shift in THz bands due to the effect of cooling airflow turbulence, which causes cables (lying in the wireless propagation path) to vibrate is also measured. A two-dimensional (2-D) geometrical propagation model that includes moving scatterers (cables) is introduced. From the 2-D model, a corresponding Doppler power spectrum (DPS) is derived and validated with measured data. This work is pertinent to THz wireless systems design for a data center environment.

This paper presents a new micro-architectural vulnerability on the power management units of modern computers which creates an electromagnetic-based side-channel. The key observations that enable us to discover this sidechannel are: 1) in an effort to manage and minimize power consumption, modern microprocessors have a number of possible operating modes (power states) in which various sub-systems of the processor are powered down, 2) for some of the transitions between power states, the processor also changes the operating mode of the voltage regulator module (VRM) that supplies power to the affected sub-system, and 3) the electromagnetic (EM) emanations from the VRM are heavily dependent on its operating mode. As a result, these state-dependent EM emanations create a side-channel which can potentially reveal sensitive information about the current state of the processor and, more importantly, the programs currently being executed. To demonstrate the feasibility of exploiting this vulnerability, we create a covert channel by utilizing the changes in the processor's power states. We show how such a covert channel can be leveraged to exfiltrate sensitive information from a secured and completely isolated (air-gapped) laptop system by placing a compact, inexpensive receiver in proximity to that system. To further show the severity of this attack, we also demonstrate how such a covert channel can be established when the target and the receiver are several meters away from each other, including scenarios where the receiver and the target are separated by a wall. Compared to the state-of-the-art, the proposed covert channel has >3x higher bit-rate. Finally, to demonstrate that this new vulnerability is not limited to being used as a covert channel, we demonstrate how it can be used for attacks such as keystroke logging.

Side-channel attacks have become a serious security concern for computing systems, especially for embedded devices, where the device is often located in, or in proximity to, a public place, and yet the system contains sensitive information. To design systems that are highly resilient to such attacks, an accurate and efficient design-stage quantitative analysis of side-channel leakage is needed. For many systems properties (e.g., performance, power, etc.), cycle-accurate simulation can provide such an efficient-yet-accurate design-stage estimate. Unfortunately, for an important class of side-channels, electromagnetic emanations, such a model does not exist, and there has not even been much quantitative evidence about what level of modeling detail (e.g., hardware, microarchitecture, etc.) would be needed for high accuracy. This paper presents EMSim, an approach that enables simulation of the electromagnetic (EM) side-channel signals cycle-by-cycle using a detailed micro-architectural model of the device. To evaluate EMSim, we compare its signals against actual EM signals emanated from real hardware (FPGA-based RISC-V processor), and find that they match very closely. To gain further insights, we also experimentally identify how the accuracy of the simulation degrades when key microarchitectural features (e.g., pipeline stall, cache-miss, etc.) and other hardware behaviors (e.g., data-dependent switching activity) are omitted from the simulation model. We further evaluate how robust the simulation-based results are, by comparing them to real signals collected in different conditions (manufacturing, distance, etc.). Finally, to show the applicability of EMSim, we demonstrate how it can be used to measure side-channel leakage through simulation at design-stage.

This paper investigates unintended radiated emissions from cellphones to identify operational status of rear/front camera. We implement a supervised learning method to achieve our goal. In the training phase, we collect data for possible combinations of phone model and camera status. Then, we apply two-phase-dimension-reduction method for better and effective classification. The first dimension-reduction phase is averaging magnitudes of frequency components of a sliding window, which is followed by applying principle component analysis (PCA) technique to reduce the dimension further. In testing phase, k-Nearest-Neighbors (k-NN) algorithm is utilized to classify test data. Finally, we provide examples to show that emanated EM signals from cellphone cameras can exfiltrate useful information.

This paper proposes a method for efficient identification of instruction-dependent sources on a printed circuit board (PCB) by localizing magnetic field sources from a limited number of measurements around the PCB. We first excite the processor by generating an artificial leakage signal at a specific frequency that is directly related to processor instructions. Then, we collect all three components of the magnetic field, but only at locations around the edge of the board. Furthermore, we model these magnetic field sources and then solve a forward–backward optimization problem using the model and measured data to identify the locations of the magnetic field sources, the magnitudes of the moments, and their orientations. The localization results are first verified using simulations, then tested when noise is added to the simulation results, and finally verified against measurements on field-programmable gate array (FPGA) and internet of things (IoT) development boards. The results show that the number of strong magnetic field sources on a board depends on the instructions used to excite the board. Furthermore, the results show that the proposed localization algorithm can accurately identify those sources, regardless of the frequency at which the measurements are conducted and the instruction pairs that are executed. Finally, the proposed method can significantly reduce the number of measurement points and the time needed to identify magnetic field sources on a PCB.

This paper proposes a new geometry-based shallow underwater acoustic (UWA) channel model allowing for nonisovelocity ocean conditions. The fact that the isovelocity assumption does not hold in many real-world scenarios motivates the need for developing channel models for nonisovelocity UWA propagation environments. Starting from a geometrical model, we develop a stochastic channel model for a single-input single-output (SISO) vehicle-to-vehicle UWA channel assuming that the ocean surface and bottom are rough and that the speed of sound varies with depth. The effect of the nonisovelocity condition has been assessed regarding its influence on the temporal autocorrelation function, the frequency correlation function (FCF), and the power delay profile of the UWA channel model. The UWA channel model has also been validated by matching its FCF as well as the therefrom derived main characteristic quantities, such as the average delay, delay spread, and coherence bandwidth against measurement data. The proposed UWA channel model is very useful for the design and performance analysis of UWA communication systems under realistic propagation conditions.