Power Traces Research Articles

Reaching Long-Term Stability in CP-ϕOTDR

Distributed Acoustic Sensing (DAS) based on coherent reflectometry with chirped pulses (CP-ϕOTDR) is a recent, yet widely recognized technique in providing spatially-resolved distributed measurements of certain physical quantities over the length of an optical fiber. Any given perturbation along the cable can be retrieved as a local temporal shift of the backscattered optical power trace, and recovered using sequential trace-to-trace correlations. However, as a technique that relies on a General Cross-correlation (GCC) estimation function, it displays a non-zero probability of obtaining anomalous estimations, which can fundamentally limit the long-term performance. Furthermore, some demonstrated strategies proposed to mitigate this effect can directly lead to the emergence of cumulative errors, which become as critical as the measurement time increases. Here, we analyze the errors affecting the long-term stability in CP-ϕOTDR systems, and we propose several strategies and processing methods to mitigate their effect. We demonstrate a ∼3 mK error after a one-month continuous temperature experiment performed to a SMF, reaching unprecedented temperature stability in CP-ϕOTDR systems with important implications in emerging fields such as DAS seismology or oceanography.

ThANNCs for kinetically optimizing ITC

For decades, isothermal titration calorimetry (ITC) has been an indispensable tool for determining the thermodynamics of macromolecular binding equilibria. Stoichiometry, binding constants (affinity), free energy, enthalpy, and entropy differences between bound and free states can readily be obtained through the measurement of the heat of association. Most modern ITCs operate on the principle of power compensation between a reference cell and a sample cell containing the titrand (i.e., a protein) into which the titrant (i.e., a small-molecule ligand, inhibitor, or another macromolecule) is injected. Upon binding, a small amount of heat is released or absorbed, and the calorimeter compensates for the temperature change by applying or withdrawing heat to the sample cell in order to maintain a constant temperature throughout the reaction time. This gives rise to a differential power trace over time that is integrated to directly determine the enthalpy of binding. Subsequent analysis of a series of injections at different mole ratios of the interacting species in solution can provide binding affinities and the stoichiometry of the association.

A Low-Overhead and High-Security Cryptographic Circuit Design Utilizing the TIGFET-Based Three-Phase Single-Rail Pulse Register against Side-Channel Attacks

Side-channel attack (SCA) reveals confidential information by statistically analyzing physical manifestations, which is the serious threat to cryptographic circuits. Various SCA circuit-level countermeasures have been proposed as fundamental solutions to reduce the side-channel vulnerabilities of cryptographic implementations; however, such approaches introduce non-negligible power and area overheads. Among all of the circuit components, flip-flops are the main source of information leakage. This article proposes a three-phase single-rail pulse register (TSPR) based on the three-independent-gate field effect transistor (TIGFET) to achieve all desired properties with improved metrics of area and security. TIGFET-based TSPR consumes a constant power (MCV is 0.25%), has a low delay (12 ps), and employs only 10 TIGFET devices, which is applicable for the low-overhead and high-security cryptographic circuit design compared to the existing flip-flops. In addition, a set of TIGFET-based combinational basic gates are designed to reduce the area occupation and power consumption as much as possible. As a proof of concept, a simplified advanced encryption algorithm (AES), SM4 block cipher algorithm (SM4), and light-weight cryptographic algorithm (PRESENT) are built with the TIGFET-based library. SCA is implemented on the cryptographic implementations to prove its SCA resilience, and the SCA results show that the correct key of cryptographic circuits with TIGFET-based TSPRs is not guessed within 2,000 power traces.

Switching behavior of the gamma power in the neuronal network modulated by the astrocytes

Understanding the dynamical neural gamma oscillation during brain state switch has been accepted as a critical step to explain attention and related human behaviors. Recent experimental studies have found a specific pulse of gamma power traces, coexisting with a pulse of functional magnetic resonance imaging with energy consumption by utilizing intracranial electroencephalography and neuroimaging. This phenomenon implies that the gamma oscillation is crucial in the success of the attention switching process after the attention task termination. However, until now no experimental evidence exists that explains how this type of gamma oscillation occurs and participates in the attention switching process. In this paper, the neuron-astrocyte-capillary network model was established, by utilizing the mathematical models of neurons and astrocytes that could explain the micro-scale behavior of neurons and investigated the formation process of this type of gamma oscillation. Our simulation results showed that the astrocyte calcium activity was pivotal in the occurrence of gamma oscillation after the attention task termination, and properly explained the underlying mechanisms of the dynamical switching of brain neuronal networks.

Guarding Machine Learning Hardware Against Physical Side-channel Attacks

Machine learning (ML) models can be trade secrets due to their development cost. Hence, they need protection against malicious forms of reverse engineering (e.g., in IP piracy). With a growing shift of ML to the edge devices, in part for performance and in part for privacy benefits, the models have become susceptible to the so-called physical side-channel attacks. ML being a relatively new target compared to cryptography poses the problem of side-channel analysis in a context that lacks published literature. The gap between the burgeoning edge-based ML devices and the research on adequate defenses to provide side-channel security for them thus motivates our study. Our work develops and combines different flavors of side-channel defenses for ML models in the hardware blocks. We propose and optimize the first defense based on Boolean masking . We first implement all the masked hardware blocks. We then present an adder optimization to reduce the area and latency overheads. Finally, we couple it with a shuffle-based defense. We quantify that the area-delay overhead of masking ranges from 5.4× to 4.7× depending on the adder topology used and demonstrate a first-order side-channel security of millions of power traces. Additionally, the shuffle countermeasure impedes a straightforward second-order attack on our first-order masked implementation.

Cross subkey side channel analysis based on small samples

The majority of recently demonstrated Deep-Learning Side-Channel Analysis (DLSCA) use neural networks trained on a segment of traces containing operations only related to the target subkey. However, when the size of the training set is limited, as in this paper with only 5K power traces, the deep learning (DL) model cannot effectively learn the internal features of the data due to insufficient training data. In this paper, we propose a cross-subkey training approach that acts as a trace augmentation. We train deep-learning models not only on a segment of traces containing the SBox operation of the target subkey of AES-128 but also on segments for other 15 subkeys. Experimental results show that the accuracy of the subkey combination training model is 28.20% higher than that of the individual subkey training model on traces captured in the microcontroller implementation of the STM32F3 with AES-128. And validation is performed on two additional publicly available datasets. At the same time, the number of traces that need to be captured when the model is trained is greatly reduced, demonstrating the effectiveness and practicality of the method.

A Novel Model for Resisting Side Channel Attack by Masking of Gates

The XOR gate is often used in cryptography modules. These cells' hardware implementations are subject to power analysis attacks. Correlation power attacks (CPAs) allow an attacker to estimate a highly correlated hypothetical value from the actual hidden value. By masking the input and unmaking the output, the present countermeasure technology randomises the power consumption pattern and increases the number of cells. We proposed the mask XOR gate in this study because they do not require cell unmasking and demonstrate a smaller correlation between power traces and input data.

Assessment of Addition-Chain-Based Masked S-Box Using Deep-Learning-Based Side-Channel Attacks

Masking schemes are considered to be effective countermeasures to protect Internet-of-Things devices from side-channel attacks. Deep-learning-based side-channel attacks (DL-SCAs) have been demonstrated to be very effective targeting on masked implementations. In this paper, we investigate the resistance of a popular computation-based masking scheme against DL-SCAs, that is, the addition-chain-based one. We find that addition chain introduces computations of intermediate monomials over F 2 n with smaller output sizes, which decreases its resistance against DL-SCAs. Specifically, we first use mutual information metric to evaluate the side-channel resistance of different monomials from an information theory point of view. Next, we further propose the Kullback–Leibler divergence ratio as an evaluation metric to analyze the impact of monomial output size on DL-SCAs. The measurement values show that the monomial with smaller output size is less-resistant against DL-SCAs. Then we conduct simulated and practical experiments respectively to verify it. In simulated experiments, we perform DL-SCAs on first-order masked implementations with different noise levels and training trace numbers. The results demonstrate that monomials with smaller output size are more vulnerable. Moreover, with the increase (resp. decrease) in noise level (resp. training trace number), the resistance difference of these monomials becomes more significant. In addition, we obtain similar results through simulated experiments on second-order masked scenario. In practical experiments based on an ARM Cortex-M4 architecture, we collect power and electromagnetic traces in consideration of low and high noise levels. The results show that the number of required traces for targeting the S-Box output is at least three times as much that for targeting the weakest monomial.

Real-time instruction-level verification of remote IoT/CPS devices via side channels

In recent years, with the rise of IoT technology, wireless Cyber-Physical Systems (CPS) have become widely deployed in critical infrastructure, including power generation, military systems, and autonomous and unmanned vehicles. The introduction of network connectivity for data transfer, cloud support, etc., into CPS, can lead to malware injection. Meanwhile, outsourcing of advanced technology node fabrication overseas makes it difficult to protect these devices from malicious modification and hardware Trojans. For solving these issues, traditional anomaly detection methods insert monitoring circuits or software into the target device but come with high overhead and power consumption. Alternative anomaly detection methods occur offline and use large equipment like oscilloscopes and PCs to collect and process side-channel traces. While they can achieve high accuracy in detecting various anomalies, they are difficult to use in practice due to their large, expensive setups. In this paper, we introduce a new instruction-level verification methodology that uses a low-cost, external add-on to monitor the power traces of a target device. This methodology possesses fine-grained granularity and could protect the target device from any malware or hardware Trojans that alter even a single instruction inside the target device. The hardware used is a tiny (20 times 20 mm), custom-designed PCB called RASC that collects power traces, performs real-time malware detection, and transmits outcomes to security administrators via Bluetooth. The proposed methodology is demonstrated on 6 benchmarks with two types of malware on an Atmel AVR device, and the accuracy between offline and real-time malware detection is compared.

An Evaluation of Power Side-Channel Resistance for RNS Secure Logic

In this paper, residue number system (RNS) based logic is proposed as a protection against power side-channel attacks. Every input to RNS logic is encrypted as a share of the original input in the residue domain through modulus values. Most existing countermeasures enhance side-channel privacy by making the power trace statistically indistinguishable. The proposed RNS logic provides cryptographic privacy that also offers side-channel resistance. It also offers side-channel privacy by mapping different input bit values into similar bit encodings for the shares. This property is also captured as a symmetry measure in the paper. This side-channel resistance of the RNS secure logic is evaluated analytically and empirically. An analytical metric is developed to capture the conditional probability of the input bit state given the residue state visible to the adversary, but derived from hidden cryptographic secrets. The transition probability, normalized variance, and Kullback–Leibler (KL) divergence serve as side-channel metrics. The results show that our RNS secure logic provides better resistance against high-order side-channel attacks both in terms of power distribution uniformity and success rates of machine learning (ML)-based power side-channel attacks. We performed SPICE simulations on Montgomery modular multiplication and Arithmetic-style modular multiplication using the FreePDK 45 nm Technology library. The simulation results show that the side-channel security metrics using KL divergence are 0.0204 for Montgomery and 0.0020 for the Arithmetic-style implementation. This means that Arithmetic-style implementation has better side-channel resistance than the Montgomery implementation. In addition, we evaluated the security of the AES encryption with RNS secure logic on a Spartan-6 FPGA Board. Experimental results show that the protected AES circuit offers 79% higher resistance compared to the unprotected AES circuit.

Maximal overlap discrete wavelet transform‐based power trace alignment algorithm against random delay countermeasure

Random delay countermeasures introduce random delays into the execution flow to break the synchronization and increase the complexity of the side channel attack. A novel method for attacking devices with random delay countermeasures has been proposed by using a maximal overlap discrete wavelet transform (MODWT)-based power trace alignment algorithm. Firstly, the random delay in the power traces is sensitized using MODWT to the captured power traces. Secondly, it is detected using the proposed random delay detection algorithm. Thirdly, random delays are removed by circular shifting in the wavelet domain, and finally, the power analysis attack is successfully mounted in the wavelet domain. Experimental validation of the proposed method with the National Institute of Standards and Technology certified Advanced Encryption Standard-128 cryptographic algorithm and the SAKURA-G platform showed a 7.5× reduction in measurements to disclosure and a 3.14× improvement in maximum correlation value when compared with similar works in the literature.

Hardware Engineer’s Guide to a Brushless-DC Motor Controller: Design and challenges

Brushless-dc (BLDC) motors have best-in-class torque to weight ratio, high efficiency, and effective control algorithms, which make them effective solutions in applications requiring high power density, such as cordless power and garden tools, unmanned aerial vehicles (UAV), robotics, and others. Improvements in semiconductor packaging technology, motor control algorithms, and power management integrated circuits (ICs) have increased the industrial uptake of BLDC motors. High-power battery-powered motor-drive solutions require power levels ranging from a few watts to hundreds or even thousands of watts. High wattage systems require high motor currents, resulting in design challenges of system losses and thermal management. A system designer’s challenge is to accommodate all the functionalities of a motor controller in a compact form for the whole range operation. Typically, a motor controller uses an analog signal chain, analog power management, and digital components with both signal and power traces on the same board. A well-designed printed circuit board (PCB) is required for the system to operate efficiently. This article lays the guidelines for designing a BLDC motor drive PCB.

An innovative edge-based Internet of Energy solution for promoting energy saving in buildings

Due to the ubiquity and maturity of Artificial Intelligence (AI), it became an essential tool in the development real-time Internet of energy (IoE) solutions. Also, since cloud platforms are not being the first implementation choice due to their bandwidth and latency issues that limit data transmission capacity, Edge Computing is becoming a popular alternative in both IoE and IoT applications. To that end, a novel Edge IoE system is proposed, namely M2SP-EdgeIoE, which enables various potential IoE use scenarios for domestic energy efficiency applications. Specifically, it incorporates (i) the sensing unit used as input stage for collecting data; (ii) the energy disaggregation unit, in which non-intrusive load monitoring algorithms are implemented to identify appliances using their disaggregated power traces; (iii) the anomaly detection platform in which energy consumption abnormalities are detected using multimodal data and AI algorithms; and (iv) the recommender system unit that helps in generating tailored recommendations for improving energy consumption behavior. Promising performance has been obtained under a number of scenarios, for example, an accuracy of 98.49% and 95% have been reached for appliance identification and anomaly detection, respectively. In conclusion, the M2SP-EdgeIoE provides a blueprint for the future of Edge IoE solutions for improved global energy efficiency.

A gradient deconvolutional network for side-channel attacks

Recently, deep learning has been introduced as an interesting alternative to perform side-channel attacks, which are nowadays well-known threats to secure systems in the electronic equipment. However, these end-to-end devices can limit their adoption in the complex power traces due to lack of transparency. In this work, we propose a new deconvolution architecture to evaluate the security of secure systems, which combines gradient calculation and deconvolutional operation. First, we use the U-Net-like structure to classify to verify the positive impact of the deconvolution on classification. Next, we propose a gradient deconvolution network (GDN), which combines gradient calculation and model training firstly. The result of gradient calculation locates the leakage and transfers the information to the model to get a better training effect. Finally, we evaluate our methodology with the public datasets and provide visualization of Points of Interest (POIs).

Distributed strain and temperature fast measurement in Brillouin optical time-domain reflectometry based on double-sideband modulation.

A novel distributed strain and temperature fast measurement method in Brillouin optical time-domain reflectometry (BOTDR) system based on double-sideband (DSB) modulation is proposed. The single-wavelength probe light is modulated into dual-wavelength probe light with a fixed phase difference by using carrier suppressed DSB modulation. The interaction between the Brillouin scattering signals corresponding to dual-wavelength probe light forms a Brillouin beat spectrum (BBS). The distributed temperature and strain are obtained by only measuring the peak power trace of the BBS and one of the slope power trace of the two Brillouin gain spectrum (BGS) corresponding to dual-wavelength probe light. The proposed method does not require scanning the Brillouin spectrum and does not require using optical fibers with multiple Brillouin scattering peaks as sensing fibers, and thus features fast measurement speed and wide variety of sensing fiber types. In a proof-of-concept experiment, the temperature uncertainty of 1.3 °C and the strain uncertainty of 36.3 με are respectively achieved over a 4.5-km G.657 fiber with 3 m spatial resolution and 30 s measurement time. The experimental measurement uncertainties of temperature and strain of the proposed method are almost equivalent to that of the method by using BGS scanning and special fibers.

Side-channel Attack Using Word Embedding and Long Short Term Memories

Side-channel attack (SCA) based on machine learning has proved to be a valid technique in cybersecurity, especially subjecting to the symmetric-key crypto implementations in serial operation. At the same time, parallel-encryption computing based on Field Programmable Gate Arrays (FPGAs) grows into a new influencer, but the attack results using machine learning are exiguous. Research on the traditional SCA has been mostly restricted to pre-processing: Signal Noisy Ratio (SNR) and Principal Component Analysis (PCA), etc. In this work, firstly, we propose to replace Points of Interests (POIs) and dimensionality reduction by utilizing word embedding, which converts power traces into sensitive vectors. Secondly, we combined sensitive vectors with Long Short Term Memories (LSTM) to execute SCA based on FPGA crypto-implementations. In addition, compared with traditional Template Attack (TA), Multiple Multilayer Perceptron (MLP) and Convolutional Neural Network (CNN). The result shows that the proposed model can not only reduce the manual operation, such as parametric assumptions and dimensionality setting, which limits their range of application, but improve the effectiveness of side-channel attacks as well.

Low Complexity Correlation Power Analysis by Combining Power Trace Biasing and Correlation Distribution Techniques

Side channel attack (SCA) is a class of crypt-analytic attacks for security evaluation of cryptographic and embedded microprocessor implementations. Among several SCA approaches, the correlation power analysis (CPA) is an efficient way to recover the secret key of the specific cryptographic algorithms running on the target devices such as embedded microprocessors. However, the evaluation process is time-consuming since a large number of traces are required to overcome the impact of noise. Hence, this paper proposes new methods to reduce the computation time by using Point of Interest (POI) extractor with the power trace biasing technique and the correlation distribution for the low complexity correlation power analysis (CPA). The theoretical explanations are provided and the experiments on different platforms such as ASCAD and RISC-V processor based databases are conducted to justify the proposed techniques. Especially, our experiments are performed with different protected schemes such as masking, hiding and combined hiding-masking techniques. The experimental results indicate that our proposed methods provide reliable results in comparison with the standard CPA. By using only a half of the power traces for taking the POIs, our first proposal not only decreases the execution time approximately by half but also enhances the success rate of the attack. Moreover, the second method based on power trace biasing technique is proposed in order to achieve better results and reduce the number of traces needed for selecting the POIs. With only 28.9% of given power traces needed, our second proposed technique reduces the execution time to only 2.6 times of the standard CPA.

Deep-Learning-Based Side-Channel Analysis of Block Cipher PIPO With Bitslice Implementation

Recently, as deep learning has been applied to various fields, deep-learning-based side-channel analysis (SCA) has been widely investigated. Unlike traditional SCA, it can perform well independently of the attacker’s ability. In this paper, we propose deep-learning-based profiled and non-profiled SCA of PIPO, (Plug-In Plug-Out), which is a bitslice block cipher that can effectively apply a countermeasure for SCA. Our datasets were captured from three different boards (XMEGA128D4, MSP430F2618, STM32F303) running PIPO-64/128. For profiled SCA, the identity (ID) labeling method exhibited better performance than the most significant bit (MSB) and hamming weight (HW) labeling methods. That is, even if each bit of the S-Box output was distributed in the power traces by the bitslice implementation, the neural network trained well each bit of the S-Box output by itself. For non-profiled SCA, we proposed a novel labeling technique that considers bitslice characteristics. We compared our proposed labeling method to MSB and HW labeling by analyzing the three aforementioned datasets. For non-profiled SCA, the proposed labeling method was more effective than the MSB and HW labeling methods on all datasets.

MAGNETIC: Multi-Agent Machine Learning-Based Approach for Energy Efficient Dynamic Consolidation in Data Centers

Improving the energy efficiency of data centers while guaranteeing Quality of Service (QoS), together with detecting performance variability of servers caused by either hardware or software failures, are two of the major challenges for efficient resource management of large-scale cloud infrastructures. Previous works in the area of dynamic Virtual Machine (VM) consolidation are mostly focused on addressing the energy challenge, but fall short in proposing comprehensive, scalable, and low-overhead approaches that jointly tackle energy efficiency and performance variability. Moreover, they usually assume over-simplistic power models, and fail to accurately consider all the delay and power costs associated with VM migration and host power mode transition. These assumptions are no longer valid in modern servers executing heterogeneous workloads and lead to unrealistic or inefficient results. In this paper, we propose a centralized-distributed low-overhead failure-aware dynamic VM consolidation strategy to minimize energy consumption in large-scale data centers. Our approach selects the most adequate power mode and frequency of each host during runtime using a distributed multi-agent Machine Learning (ML) based strategy, and migrates the VMs accordingly using a centralized heuristic. Our Multi-AGent machine learNing-based approach for Energy efficienT dynamIc Consolidation (MAGNETIC) is implemented in a modified version of the CloudSim simulator, and considers the energy and delay overheads associated with host power mode transition and VM migration, and is evaluated using power traces collected from various workloads running in real servers and resource utilization logs from cloud data center infrastructures. Results show how our strategy reduces data center energy consumption by up to 15 percent compared to other works in the state-of-the-art (SoA), guaranteeing the same QoS and reducing the number of VM migrations and host power mode transitions by up to 86 and 90 percent, respectively. Moreover, it shows better scalability than all other approaches, taking less than 0.7 percent time overhead to execute for a data center with 1,500 VMs. Finally, our solution is capable of detecting host performance variability due to failures, automatically migrating VMs from failing hosts and draining them from workload.

A Novel Approach to the Detection and Imaging of Candidate Martian Subglacial Water Bodies by Radar Sounder Data

Research based on Mars Advanced Radar for Subsurface and Ionosphere Sounding (MARSIS) data detected unusual radar bright basal reflections located at about 1.5 km depth in a Mars region denoted as Ultimi Scopuli. These reflections were interpreted as a signature of subglacial liquid water even though this interpretation is still being debated in the literature. In this article, we propose a novel approach to the detection and imaging of candidate subglacial liquid water from radar sounding data. The approach combines the radar echo power traces with a suitable digital elevation model to provide a bidimensional representation of the surface. Even if the imaging method reconstructs a representation of the surface, we prove that it can be used to identify subsurface bright reflections in icy regions. Imaging is feasible even if the basal interface is not directly included in the processed data for image generation. To support this experimental evidence, we show that a relationship exists between the value of the reflected echo power originating from the englacial layers and the basal-to-surface-echo-power ratio. The observed relationship holds on both Ultimi Scopuli radar sounding data acquired on Mars and Lake Vostok data acquired on Earth. Our results show that the 2-D imaging provides an alternative way for locating candidate subglacial liquid water bodies on Mars over large areas also where the basal interface is not directly measured. The proposed approach complements previous research for further evaluation of the actual presence of liquid water on Mars.