Electromagnetic Side-channel Analysis Research Articles

Revealing IoT Cryptographic Settings through Electromagnetic Side-Channel Analysis

The advancement of cryptographic systems presents both opportunities and challenges in the realm of digital forensics. In an era where the security of digital information is crucial, the ability to non-invasively detect and analyze cryptographic configurations has become significant. As cryptographic algorithms become more robust with longer key lengths, they provide higher levels of security. However, non-invasive side channels, specifically through electromagnetic (EM) emanations, can expose confidential cryptographic details, thus presenting a novel solution to the pressing forensic challenge. This research delves into the capabilities of EM side-channel analysis (EM-SCA), specifically focusing on detecting both cryptographic key lengths and the algorithms employed utilizing a machine-learning-based approach, which can be instrumental for digital forensic experts during their investigations. Through meticulous data processing and analysis, the Support Vector Machine (SVM) model, among others, demonstrated a notable accuracy of 94.55% in distinguishing between AES and ECC cryptographic operations. This capability significantly enhances digital forensic methodologies, offering a novel avenue for noninvasively uncovering encrypted data’s cryptographic settings. By identifying key lengths and algorithms without invasive procedures, this research contributes substantially to the advancement of forensic investigations in encrypted environments.

Ensuring cross-device portability of electromagnetic side-channel analysis for digital forensics

Investigation on smart devices has become an essential subdomain in digital forensics. The inherent diversity and complexity of smart devices pose a challenge to the extraction of evidence without physically tampering with it, which is often a strict requirement in law enforcement and legal proceedings. Recently, this has led to the application of non-intrusive Electromagnetic Side-Channel Analysis (EM-SCA) as an emerging approach to extract forensic insights from smart devices. EM-SCA for digital forensics is still in its infancy, and has only been tested on a small number of devices so far. Most importantly, the question still remains whether Machine Learning (ML) models in EM-SCA are portable across multiple devices to be useful in digital forensics, i.e., cross-device portability. This study experimentally explores this aspect of EM-SCA using a wide set of smart devices. The experiments using various iPhones and Nordic Semiconductor nRF52-DK devices indicate that the direct application of pre-trained ML models across multiple identical devices does not yield optimal outcomes (under 20 % accuracy in most cases). Subsequent experiments included collecting distinct samples of EM traces from all the devices to train new ML models with mixed device data; this also fell short of expectations (still below 20 % accuracy). This prompted the adoption of transfer learning techniques, which showed promise for cross-model implementations. In particular, for the iPhone 13 and nRF52-DK devices, applying transfer learning techniques resulted in achieving the highest accuracy, with accuracy scores of 98 % and 96 %, respectively. This result makes a significant advancement in the application of EM-SCA to digital forensics by enabling the use of pre-trained models across identical or similar devices.

Crossed-IoT Device Portability of Electromagnetic Side Channel Analysis: Challenges and Dataset

Internet of Things (IoT) refers to the network of interconnected physical devices, vehicles, home appliances, and other items embedded with sensors, software, and connectivity, enabling them to collect and exchange data. IoT forensics aim to investigate cybercrimes, security breaches, and other malicious activities that may have taken place on these connected devices. In particular, Electromagnetic Side-Channel Analysis (EM-SCA) has become an essential tool for IoT forensics due to its ability to reveal confidential information about the internal functions of IoT devices without interfering with these devices or wiretapping their networks. However, the accuracy and reliability of EM-SCA results can be limited by device variability, environmental factors, and data collection and processing methods. In fact, very few studies have explored potential solutions to address the significant impact of these limitations on the accuracy of EM-SCA approaches applied to crossed IoT devices. Therefore, this paper examines the impact of device variability on the accuracy and reliability of machine learning (ML)-based approaches for EM-SCA. We first present the background, basic concepts and techniques used to evaluate the limitations of current EM-SCA approaches and datasets. Our study then addresses one important limitation, which is caused by the multi-core architecture of the processors (aka. System-On-Chip). We present an approach to collect the EM-SCA datasets and demonstrate the feasibility of using transfer learning to obtain more meaningful and reliable results from EM-SCA in IoT forensics of crossed-IoT devices. Moreover, this study contributes a new dataset for using deep learning (DL) models in analyzing Electromagnetic Side-Channel data with regard to the cross-device portability matter.

Mobile applications identification using autoencoder based electromagnetic side channel analysis

Various applications are deployed on mobile smart devices in almost every situations of our life, while in some of these situations sensitive applications are strictly prohibited, such as cameras in cinemas and browsers in examination halls. Real-time recognition of applications running on mobile smart devices is of great significance in these cases. However, most of the existing technologies have the limitation that they require system permissions to obtain the running application list which is banned by mainstream mobile operating systems. Noting that the launch of a certain application will emit a unique pattern of magnetic field, we introduce magnetic field side channel analysis to recognize running applications. However, magnetic field side channel analysis is challenging since it is hard to extract features from magnetic field data without domain experts. Besides, real-time applications identification demands accurate detection of applications launching. To overcome these challenges, we extract robust depth features using autoencoder and implement online application recognition by introducing finite-state machine to identify the application launch window from raw data. The proposed method is evaluated by recognizing 1000 different applications in real environment. The experiment results show that the proposed method is feasible and effective in real-time application identification.

Locality-based electromagnetic leakage assessment using CNN

Deep learning side-channel analysis (SCA) attacks have recently gained in popularity. The ability of deep learning models to retrieve a key byte while minimizing the need for pre-processing steps in both cases of misaligned traces and when the leakage model is multivariate has contributed to the popularity gain. Near-field electromagnetic (EM) probes have enabled leakage capture with high spatial resolution, and the field of deep learning side-channel research looks to find models which reduce the required number of leakage traces to retrieve a key byte successfully. However, despite the many papers researching techniques to reduce the number of traces required for a successful attack, location-based research for EM SCA remains untouched. Due to the nature of EM probes and the architecture of different boards and chips, the location of the collection probe becomes important when attempting to extract the secret key within a reasonable timeframe and with a level of certainty in the result. Our contribution is a framework to determine the best location to assess localized EM leakage against a given chip platform. We use a raster scan to collect localized leakage results at 25 points in a 5x5 grid pattern on a ChipWhisperer Lite XMEGA board running an open-source implementation of the AES-128 encryption algorithm. We demonstrate the use of our framework to locate the best points for an attacker to execute a profiling attack by identifying the grid point with the most detectable leakage for a chip platform. We further execute a smaller localized 25-point raster scan in a grid over the identified location to further refine our estimate of the optimal collection location. We then demonstrate that this location can be used to execute a side-channel profiling attack against the same chip architecture and will result in a lower number of traces required to retrieve the key byte.

EM SCA White-Box Analysis-Based Reduced Leakage Cell Design and Presilicon Evaluation

This work presents a white-box modeling of the electromagnetic (EM) leakage from an integrated circuit (IC) to develop EM side-channel analysis (SCA)-aware design techniques. A new digital library cell layout design technique is proposed to minimize the EM leakage and is evaluated using a high-frequency structure simulator (HFSS)-based framework. Backed by our physics-based understanding of EM radiation, the proposed double-row power grid-based digital cell layout design shows <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$&gt;5\times $ </tex-math></inline-formula> reduction in the EM SCA leakage compared to the traditional digital logic gate layout design. Furthermore, exploiting the magneto-quasistatic (MQS) regime of operation of the EM leakage from the CMOS circuits, the HFSS-based framework is utilized to develop a pre-silicon (Si) EM SCA evaluation technique to assess the vulnerability of cryptographic implementations against such attacks during the design phase itself.

Mitigating Electromagnetic Side-Channel Attacks

By providing new sources of electronic evidence, the Internet of Things (IoT) has opened up new possibilities for digital forensics. Obtaining electronic data from IoT, on the other hand, is a difficult process for a variety of reasons, including the use of various types of standard interfaces, the use of light-weight data encryption, such as elliptic curve cryptography (ECC), and so on. The use of electromagnetic side-channel analysis (EM-SCA) to obtain forensically valuable electronic data from IoT devices has been proposed. EM side-channel analysis is a technique for eavesdropping on the operations and data handling of computing devices using unintentional electromagnetic emissions. However, successful EM-SCA attacks on IoT devices require expert knowledge and specialized tools that are not available to most digital forensic investigators. The electromagnetic side-channel (EM-SC) is one of several types of side-channel approaches for extracting usable electronic data from IoT devices. This paper with focus on Electromagnetic side-channel (EM-SC), the positive and negative usage and how to mitigate the negative usage. Keywords: Electromagnetic, Side-channels, digital forensics, IOT, electronic evidence, Africa.

Electromagnetic Analysis of Integrated On-Chip Sensing Loop for Side-Channel and Fault-Injection Attack Detection

Securing crypto-cores is becoming increasingly difficult with the advent of electro-magnetic (EM) side-channel analysis (EMSCA) and fault injection attacks (FIAs). This letter presents an Ansys high-frequency structure simulator (HFSS)-based simulation framework for EM analysis of an integrated on-chip sensor for detecting EMSCA and FIA and validates the efficacy of an on-chip higher metal layer loop-based zero area-overhead sensor using a custom-built 65-nm CMOS IC. A simple technique for incoming H-probe detection is also presented by measuring the absolute average of the induced voltage for every encryption.

Circuit-Variant Moving Target Defense for Side-Channel Attacks

The security of cryptosystems involves preventing an attacker's ability to obtain information about plaintext. Traditionally, this has been done by prioritizing secrecy of the key through complex key selection and secure key exchange. With the emergence of side-channel analysis (SCA) attacks, bits of a secret key may be derived by correlating key values with physical properties of cryptographic process execution. Information such as power consumption and electromagnetic (EM) radiation side-channel properties can be observed during encryption or decryption. These signals reflect data-dependent system behaviours that may reveal secret key information. Power and EM SCA attacks require several measurements of the target process to amplify the signal of interest, filter out noise, and derive the secret key through statistical analysis methods. Differential power and EM analysis attacks rely on correlating actual side-channel measurements to hypothetical models. The goal of this research is to increase the complexity of both power and EM SCA by introducing structural and spatial randomization of the target hardware. We propose a System-on-a-Chip (SOC) countermeasure that will periodically reconfigure an AES scheme using randomly located S-box circuit variants. We hypothesize that changing the location of the target modules between encryption runs will result in a nonconstant EM signal strength for any given point on the chip, increasing the number of traces needed to perform a localized EM SCA attack. Further, each of the S-box circuit variants will consist of functionally equivalent, structurally diverse hardware. By diversifying the implementations at the gate-level, we aim to vary the power behaviour observed by the attacker and disrupt the correlation between the hypothetical and actual power consumption, increasing the complexity of power SCA. This moving target defense aims to disrupt side-channel collection and correlation needed to successfully implement an attack.

Electromagnetic Side-Channel Hardware Trojan Detection Based on Transfer Learning

Hardware Trojan detection method has been given particular attentions by hardware security researchers since the failure of Syrian radars in 2007. Electromagnetic side-channel analysis is a promising method which is widely used in practice due to its advantage of efficiency, non-touch and high accuracy. In this brief, we propose a novel method using electromagnetic side-channel signal for hardware Trojan detection by transfer learning. Firstly, time-frequency information of electromagnetic signal is extracted by continuous wavelet transform to take full advantage of useful information in time domain and frequency domain. Then, time-frequency information is fed to transfer learning network to get the classification result. In order to further improve the result, we use transfer learning to further extract the key features in time-frequency information. Finally, the key features are classified by the support vector machine to improve the accuracy. The experiment is conducted on a stand FPGA board and advanced encryption standard circuit is used as the benchmark circuit. Experimental results show that our methods can improve the result efficiently.

Identifying Internet of Things software activities using deep learning-based electromagnetic side-channel analysis

Internet of Things (IoT) is becoming the new frontier in digital forensics due to the abundance of IoT devices appearing in day-to-day life. The diversity and complexity of IoT ecosystems pose a considerable challenge to digital investigators that demand novel approaches. Electromagnetic side-channel analysis (EM-SCA) has been proposed as a promising window to gather forensically useful information from IoT devices. Machine Learning (ML) techniques are instrumental when performing EM-SCA on IoT devices. Our work aims to investigate how machine learning can be applied to accurately identify complex activities on IoT devices from their generated electromagnetic noises. To this end, a range of classification models were created, including deep learning models, to predict the activity from the electromagnetic noise emitted while the device performed the activities. A dataset was generated by using ten different well-known sorting algorithms with diverse computational time complexities and running them on an Arduino Leonardo device to represent a low-powered IoT device. The algorithms were continually sorting arrays of 100 elements randomly generated in ascending order. Experiments were conducted to identify which ML methods performed better with the generated data sets. Furthermore, more experiments were conducted to identify how the methods perform depending on the window size of raw samples and the number of examples against which they are trained. From the experimental results, it is possible to predict which activity is being executed with a high level of accuracy (99.6%) with a convolutional neural network (CNN). It was also found that Random Forests (RF) and Deep Learning (DL) are suitable ML models for making predictions with EM-SCA.

Electromagnetic Side-Channel Analysis for IoT Forensics: Challenges, Framework, and Datasets

Electromagnetic (EM) side-channel radiation from Internet of Things (IoT) devices are shown to be effective at acquiring forensic insights during digital investigations. These EM radiation patterns can be analysed with the help of machine learning algorithms to detect internal behaviours of IoT devices, which can be relevant to an investigation. However, the real-world application of EM side-channel analysis for digital forensic purposes is obstructed by the lack of suitable tools and the technical expertise among law-enforcement communities. Although certain frameworks, such as EMvidence, exist to cater this requirement, the sheer diversity of the IoT ecosystem makes it difficult to support a sufficiently large collection of devices that are commonly encountered in forensic investigations. The work presented in this paper makes multiple contributions towards addressing this problem. Initially, a detailed discussion on the challenges of applying EM side-channel analysis in practical digital forensic purposes is provided, where the practical difficulties are illustrated. Then, it was shown that the existing EM side-channel analysis frameworks, such as EMvidence, can be used to overcome the diversity of IoT devices in forensics by equipping them with extensible plug-ins targeting the internal system-on-chips (SoC) of each device type. These plug-ins are expected to incorporate trained machine learning models, which are capable of recognising patterns of specific IoT device SoCs. However, the development of such plug-ins requires sufficiently diverse EM datasets from IoT devices. Facilitating this requirement, this work presents a comprehensive EM side-channel dataset representing a diverse collection of popular IoT devices and smartphones. The presented dataset is used to demonstrate the potential usage of machine learning models to recognise device behaviour.

Forensic Insights From Smartphones Through Electromagnetic Side-Channel Analysis

The increasing use of smartphones has increased their presence in legal and corporate investigations. Unlike desktop and laptop computers, forensic analysis of smartphones is a challenging task due to their limited interfaces to retrieve information of forensic value. Electromagnetic side-channel analysis (EM-SCA) has been recently proposed as an alternative window to acquire forensic insights from computers, in particularly from Internet of Things devices. Along this line, this work experimentally evaluates the potential of extracting information of forensic value from smartphones through their EM radiation. Initially, a group of smartphones representing a diverse set of system-on-chip (SoC) processors were used to acquire EM radiation traces. Later, deep learning models were trained to detect various internal software behaviours running on the SoCs. The results of this work indicates that a wide variety of insights can be extracted from smartphones through EM side-channel, increasing the potential opportunities for digital forensic investigators.

EM and Power SCA-Resilient AES-256 Through &gt;350× Current-Domain Signature Attenuation and Local Lower Metal Routing

Mathematically secure cryptographic algorithms, when implemented on a physical substrate, leak critical “side-channel” information, leading to power and electromagnetic (EM) analysis attacks. Circuit-level protections involve switched capacitor, buck converter, or series low-dropout (LDO) regulator-based implementations, each of which suffers from significant power, area, or performance tradeoffs and has only achieved a minimum traces to disclosure (MTD) of $10M$ till date. Utilizing an in-depth white-box model, this work, for the first time, focuses on signature suppression in the current domain, which provides an $Attenuation^{2}$ enhancement in MTD, leading to orders of magnitude improvement in both power and EM side-channel analysis (SCA) immunities. Using a combination of current-domain “signature attenuation” (CDSA) along with local lower level metal routing, the critical correlated information in the crypto current is significantly suppressed before it reaches the supply pin. Especially, to prevent the EM leakage from its source (metal layers carrying the correlated crypto current acting as antennas), this work embraces lower level metal routing of the CDSA embedding the crypto-IP so that the signature becomes highly suppressed before it passes through the higher metal layers (which radiates significantly) to connect to the external pin. The 65-nm CMOS test chip contains both protected and unprotected parallel AES-256 implementations, running at a clock frequency of 50 MHz. Test vector leakage assessment (TVLA) on the protected CDSA-AES, demonstrated with on-chip measurements for the first time, shows that the higher level metal layers leak significantly more compared with the lower level metal routing. Correlational power and EM analysis (CPA/CEMA) attacks on the unprotected implementation were able to extract the secret key within $8k$ and $12k$ traces, respectively, while the protected CDSA-AES could not be broken even after $1B$ encryptions for both power and EM SCA, evaluated both in the time and frequency domains, showing an improvement of $100\times $ over the prior state-of-the-art countermeasures with comparable power and area overheads.

Facilitating Electromagnetic Side-Channel Analysis for IoT Investigation: Evaluating the EMvidence Framework

The Internet of Things (IoT) has opened up new opportunities for digital forensics by providing new sources of evidence. However, acquiring data from IoT is not a straightforward task for multiple reasons including the diversity of manufacturers, the lack of standard interfaces, the use of light-weight data encryption, e.g. elliptic curve cryptography (ECC), etc. Electromagnetic side-channel analysis (EM-SCA) has been proposed as a new approach to acquire forensically useful data from IoT devices. However, performing successful EM-SCA attacks on IoT devices requires domain knowledge and specialised equipment that are not available to most digital forensic investigators. This work presents the methodology behind and an evaluation of a framework, EMvidence, that enables forensic investigators to acquire evidence from IoT devices through EM-SCA. This framework helps to automate and perform electromagnetic side-channel evidence collection for forensic purposes. An evaluation of the framework is performed by applying it to multiple realistic digital investigation scenarios. In the case of attacking ECC cryptographic operations, the evaluation demonstrates that the volume of EM data that needs to be stored and processed can be significantly reduced using the framework's machine learning based approach.

Cutting Through the Emissions: Feature Selection from Electromagnetic Side-Channel Data for Activity Detection

Electromagnetic side-channel analysis (EM-SCA) has been used as a window to eavesdrop on computing devices for information security purposes. It has recently been proposed to use as a digital evidence acquisition method in forensic investigation scenarios as well. The massive amount of data produced by EM signal acquisition devices makes it difficult to process in real-time making on-site EM-SCA infeasible. Uncertainty surrounds the precise information leaking frequency channel demanding the acquisition of signals over a wide bandwidth. As a consequence, investigators are left with a large number of potential frequency channels to be inspected; with many not containing any useful information leakages. The identification of a small subset of frequency channels that leak a sufficient amount of information can significantly boost the performance enabling real-time analysis. This work presents a systematic methodology to identify information leaking frequency channels from high dimensional EM data with the help of multiple filtering techniques and machine learning algorithms. The evaluations show that it is possible to narrow down the number of frequency channels from over 20,000 to less than a hundred (81 channels). The experiments presented show an accuracy of 0.9315 when all the 20,000 channels are used, an accuracy of 0.9395 with the highest 500 channels after calculating the variance between the average value of each class, and an accuracy of 0.9047 when the best 81 channels according to Recursive Feature Elimination are considered.

EMvidence: A Framework for Digital Evidence Acquisition from IoT Devices through Electromagnetic Side-Channel Analysis

EMvidence: A Framework for Digital Evidence Acquisition from IoT Devices through Electromagnetic Side-Channel Analysis

SCNIFFER: Low-Cost, Automated, Efficient Electromagnetic Side-Channel Sniffing

Electromagnetic (EM) side-channel analysis (SCA) is a prominent tool to break mathematically-secure cryptographic engines, especially on resource-constrained devices. Presently, to perform EM SCA on an embedded device, the entire chip is manually scanned and the MTD (Minimum Traces to Disclosure) analysis is performed at each point on the chip to reveal the secret key of the encryption algorithm. However, an automated end-to-end framework for EM leakage localization, trace acquisition, and attack has been missing. This work proposes SCNIFFER : a low-cost, automated EM Side Channel leakage SNIFFing platform to perform efficient end-to-end Side-Channel attacks. Using a leakage measure such as Test Vector Leakage Assessment (TVLA), or the signal to noise ratio (SNR), we propose a greedy gradient-search heuristic that converges to one of the points of highest EM leakage on the chip (dimension: $N \times N$ ) within $O(N)$ iterations, and then perform Correlational EM Analysis (CEMA) at that point. This reduces the CEMA attack time by $\sim N$ times compared to an exhaustive MTD analysis, and by $> 20\times $ compared to choosing an attack location at random. We demonstrate SCNIFFER using a low-cost custom-built 3-D scanner with an H-field probe ( $50, 000 commercial EM scanners, and a variety of microcontrollers as the devices under attack. The SCNIFFER framework is evaluated for several cryptographic algorithms (AES-128, DES, RSA) running on both an 8-bit Atmega microcontroller and a 32-bit ARM microcontroller to find a point of high leakage and then perform a CEMA at that point.

SITM: See-In-The-Middle Side-Channel Assisted Middle Round Differential Cryptanalysis on SPN Block Ciphers

Side-channel analysis constitutes a powerful attack vector against cryptographic implementations. Techniques such as power and electromagnetic side-channel analysis have been extensively studied to provide an efficient way to recover the secret key used in cryptographic algorithms. To protect against such attacks, countermeasure designers have developed protection methods, such as masking and hiding, to make the attacks harder. However, due to significant overheads, these protections are sometimes deployed only at the beginning and the end of encryption, which are the main targets for side-channel attacks.In this paper, we present a methodology for side-channel assisted differential cryptanalysis attack to target middle rounds of block cipher implementations. Such method presents a powerful attack vector against designs that normally only protect the beginning and end rounds of ciphers. We generalize the attack to SPN based ciphers and calculate the effort the attacker needs to recover the secret key. We provide experimental results on 8-bit and 32-bit microcontrollers. We provide case studies on state-of-the-art symmetric block ciphers, such as AES, SKINNY, and PRESENT. Furthermore, we show how to attack shuffling-protected implementations.

Leveraging Electromagnetic Side-Channel Analysis for the Investigation of IoT Devices

Internet of Things (IoT) devices have expanded the horizon of digital forensic investigations by providing a rich set of new evidence sources. IoT devices includes health implants, sports wearables, smart burglary alarms, smart thermostats, smart electrical appliances, and many more. Digital evidence from these IoT devices is often extracted from third party sources, e.g., paired smartphone applications or the devices' back-end cloud services. However vital digital evidence can still reside solely on the IoT device itself. The specifics of the IoT device's hardware is a black-box in many cases due to the lack of proven, established techniques to inspect IoT devices. This paper presents a novel methodology to inspect the internal software activities of IoT devices through their electromagnetic radiation emissions during live device investigation. When a running IoT device is identified at a crime scene, forensically important software activities can be revealed through an electromagnetic side-channel analysis (EM-SCA) attack. By using two representative IoT hardware platforms, this work demonstrates that cryptographic algorithms running on high-end IoT devices can be detected with over 82% accuracy, while minor software code differences in low-end IoT devices could be detected over 90% accuracy using a neural network-based classifier. Furthermore, it was experimentally demonstrated that malicious modification of the stock firmware of an IoT device can be detected through machine learning-assisted EM-SCA techniques. These techniques provide a new investigative vector for digital forensic investigators to inspect IoT devices.