Side-channel Research Articles

Memory architecture to mitigate side channel attacks for cryptographic application using loop cut technique

Cryptography is crucial in embedded systems for safeguarding sensitive information, maintaining data integrity, and facilitating secure communication. L1 cache memory enhances overall performance by temporarily storing cryptographic keys. Post-quantum cryptography (PQC) focuses on creating algorithms that stay secure even against quantum computing threats. However, PQC doesn't fully protect against side-channel attacks (SCA). As IoT devices like wearable health monitors and industrial sensors become more widespread, the demand for lightweight cryptography increases to balance security with resource constraints. Yet, lightweight cryptography can face challenges, including reduced security and increased susceptibility to SCA due to smaller key sizes. Attackers can exploit power consumption patterns through side-channel attacks (SCA), such as Power Analysis, to extract these secret keys. Once a key is compromised, encrypted data becomes vulnerable. In cloud computing cache side-channel attacks take advantage of multiple virtual machines running simultaneously on the same hardware, enabling them to extract sensitive information from encryption processes. Although many SRAM cells have been designed in the literature, none offer complete security against SCA. This paper presents a new architecture for secure cache memory using a proposed 10T SRAM cell that secures all three cell operations (read, write, and hold) against SCA attacks. Additionally, this architecture also prevents half selection issue in cache memory. The security measure of proposed-10T cell is 97.19 % which is highest among all other cells and reliability measure is 82.03 %.The cell also offers highest hold stability of 421 mV along with good read stability and write ability of 220 mV and 334 mV respectively. The leakage of Proposed-10T cell is also less i.e., 13.56 pA. The Performance and Security Factor (PSF) is computed for all considered cells, encompassing various performance and security metrics. The normalized PSF (PSF)N of the Proposed-10T cell is 2.17, the highest among all cells considered for comparison. Therefore, the Proposed-10T cell architecture is fully secure against SCA and achieves better performance during cell operations.

Domain-Agnostic Representation of Side-Channels.

Side channels are unintended pathways within target systems that leak internal target information. Side-channel sensing (SCS) is the process of exploiting side channels to extract embedded target information. SCS is well established within the cybersecurity (CYB) domain, and has recently been proposed for medical diagnostics and monitoring (MDM). Remaining unrecognised is its applicability to human-computer interaction (HCI), among other domains (Misc). This article analyses literature demonstrating SCS examples across the MDM, HCI, Misc, and CYB domains. Despite their diversity, established fields of advanced sensing and signal processing underlie each example, enabling the unification of these currently otherwise isolated domains. Identified themes are collating under a proposed domain-agnostic SCS framework. This SCS framework enables a formalised and systematic approach to studying, detecting, and exploiting of side channels both within and between domains. Opportunities exist for modelling SCS as data structures, allowing for computation irrespective of domain. Future methodologies can take such data structures to enable cross- and intra-domain transferability of extraction techniques, perform side-channel leakage detection, and discover new side channels within target systems.

Revealing CNN Architectures via Side-Channel Analysis in Dataflow-based Inference Accelerators

Convolutional Neural Networks (CNNs) are widely used in various domains, including image recognition, medical diagnosis and autonomous driving. Recent advances in dataflow-based CNN accelerators have enabled CNN inference in resource-constrained edge devices. These dataflow accelerators utilize inherent data reuse of convolution layers to process CNN models efficiently. Concealing the architecture of CNN models is critical for privacy and security. This paper evaluates memory-based side-channel information to recover CNN architectures from dataflow-based CNN inference accelerators. The proposed attack exploits spatial and temporal data reuse of the dataflow mapping on CNN accelerators and architectural hints to recover the structure of CNN models. Experimental results demonstrate that our proposed side-channel attack can recover the structures of popular CNN models, namely Lenet, Alexnet, VGGnet16, and YOLOv2.

III-V material-based junction-free L-shaped gate normal line tunneling FET for improved performance

In this paper, we introduce a novel III–V compound material-based junction-free (JF) L-shaped gate normal line tunneling field-effect transistor (III–V JF L GNLTFET) for improved output performance at 0.5 V operation. The key design metric, i.e. JF or junctionless design, in our device eliminates issues like random dopant fluctuations (RDF) and high thermal budgets and streamlines the fabrication. The implementation of III–V compound material, i.e. low bandgap compound GaSb, in the source region, combined with the larger area gate normal line tunneling, improves the ON current for our proposed III–V JF L GNLTFET device. Additionally, the utilization of large bandgap GaAs compounds on the drain and channel sides eliminates ambipolarity and further enhances the performance of our proposed device. Meaning that the proposed device simultaneously improves the ON current and suppresses the ambipolarity. Our proposed III–V JF L GNLTFET exhibits enhanced output performance with an ON current of 23.2 μA μm−1 and a minimum and average subthreshold swing of 3.7 mV dec−1 and 15.82 mV dec−1 respectively. Furthermore, the proposed III–V JF L GNLTFET also gives superior RF/analog performance with transconductance (168.65 μS), cut-off frequency (33.52 GHz), gain-bandwidth product (5.11 GHz), and transconductance-frequency product (243.7 GHz).

General process detection through side channel characterization

ABSTRACT In this study, we demonstrate the feasibility of using physical sensors in System-on-a-Chip (SoC) for real-time security monitoring by detecting and characterizing different process types, such as file I/O, CPU/ALU-intensive tasks, network I/O and virtualization. We present models that use sensor data for binary classification to determine whether a specific process category is active or inactive. Analyzing the detection results, we determine the importance of each sensor in identifying process types and providing insights into process behaviors and sensor impacts. We developed adaptive ensemble classifiers to accommodate varying load conditions, enhancing detection accuracy across diverse operational scenarios, including regular background activities that simulate real-world conditions. Our results show effective detection of file I/O and CPU/ALU-intensive processes under various loads. Virtualization processes are accurately detected under light loads but show a moderate accuracy decline under heavier conditions. Network I/O detection faces challenges due to fewer relevant sensors. Our ability to predict process categories consistently and with high performance allows us to discover behaviors of various malicious activities. This research underlines the efficacy of sensor-based analysis for reliable and adaptable real-time process monitoring, demonstrating the feasibility of using sensor data for security purposes in various environmental conditions.

Security-based low-density parity check encoder for 5G communication

The fifth generation (5G) of mobile telecommunication standards is intended to offer better performance and efficiency. One of the most significant difficulties in delivering safe data transfer through the transmission channel in the emerging 5G technology is channel-coding security. This research primarily focused on offering information transmission that is secure in the place of novel assaults such as side-channel attacks. In this research, we present a low-density parity check (LDPC) encoder that is constructed using the multiplicative masking method to overcome side-channel attacks, one of the most significant security concerns for the upcoming 5G system. As a result, it offers greater security, reduced complexity, and higher performance. Power, area, and delay can all be calculated using LDPC codes. Comparing multiplicative masking implemented LDPC encoders to ordinary channel coding techniques in terms of security seen that multiplicative masking implemented LDPC encoders offer more security. The program Xilinx ISE 14.7 can synthesize the analysis. The advantage of multiplicative masking is that it offers a promising level of security through the principle of randomization, which is the foundation of the procedure. According to the analysis, the secured transmission of the data by the proposed multiplicative masking implemented LDPC encoder is increased.

Enhancement of cooling process of hot blocks mounted inside a horizontal channel using flexible baffles — Alternative arrangement

In this paper, two heated blocks and three flexible baffles that are alternately placed on the upper and bottom sides of a rectangular channel are used to replicate the transient heat and air movement. The novelty of this research is the use of flexible baffles to destruct the thermal boundary layer with maintaining little pressure drop, and thus reducing the required pumping capacity. The finite thickness blocks are subject to a constant heat flux, while the baffles are very thin and deforms depending on the strength of the flow of coolant (air). Finite element method with arbitrary Lagrangian–Eulerian approach is used for solving such deforming domain problem. The problem is inspected transiently by varying the dimensionless time (τ=0.0 to 10) and two salient parameters which are Reynolds number Re=10−500, and baffle elasticity parameter E=105−108. Results show that the flexibility feature of the baffles contributes not only in directing the coolant towards the hot blocks, but also contributes in reducing the skin friction and pressure drop through the channel. At Re=150, the skin friction and pressure drop of the flexible baffles are 13.2% and 16.5%, respectively lesser than the rigid baffles. The improvement of Nusselt number with flexibility parameter is marginal and within a limited low Reynolds number, where the maximal improvement is about 3.4% at Re=150.

A Survey of of Side-Channel Attacks and Mitigation for Processor Interconnects

With advancements in chip technology, the number of cores in modern commercial processors continues to rise, leading to increased complexity in interconnects and on-chip networks. This complexity, however, exposes significant security vulnerabilities, primarily in the form of side-channel and covert-channel exploits. Unlike other microarchitectural side-channel attacks, those leveraging on-chip interconnects utilize unique characteristics, allowing attackers to develop novel methods that can bypass existing effective defenses. In this paper, we present a comprehensive survey of current side-channel and covert-channel attacks based on processor-on-chip interconnects. We categorize these attacks into three types: contention-based, distance-based, and layout-based, according to the specific interconnect characteristics they exploit, and discuss corresponding countermeasures for each. Finally, we provide an outlook on future development trends in processor interconnect side channels. This survey is the first to specifically focus on interconnect-based side channels in processors.

Side-channel attacks based on attention mechanism and multi-scale convolutional neural network

One widely utilized attack technique for side-channel attacks is deep learning. However, the efficiency of deep learning attacks can be impacted by the differences in data collected from various devices or environmental conditions. These differences arise from factors such as hardware discrepancies, environmental noise, and countermeasures. Such differences can disrupt the correlation between the leaked information from the target device during operations and sensitive data, leading to failures in the attacks. In order to better extract the feature information and temporal information of traces in this challenge, we propose an Attention Mechanism and Multi-Scale Convolutional Neural Network (AMCNNet). The critical components of the AMCNNet are the multi-scale convolution module and the feature extraction module. The multi-scale convolution module extracts feature of different scales from traces, improving the network's ability to capture high-level meanings and details. Then, the feature extraction module dynamically weights and rescales the features to better captures the long-term dependencies in the traces.. Through experiments conducted on publicly available datasets such as DPA Contest v4, ASCAD, and AES_HD, as well as analyzing the guessing entropy, the experimental results demonstrate that the network exhibits strong generalization capability and robustness across datasets with diverse features.

The Application of Remote Sensing Technology in Post-Disaster Emergency Investigations of Debris Flows: A Case Study of the Shuimo Catchment in the Bailong River, China

The Bailongjiang River Basin is a high-risk area for debris flow in China. On 17 August 2020, a debris flow occurred in the Shuimo catchment, Wen County, which blocked the Baishui River, forming a barrier lake and causing significant casualties and property damage. In this study, remote sensing, InSAR, field surveys, and unmanned aerial vehicle (UAV) techniques were used to analyze the causal characteristics, material source characteristics, dynamic processes, and disaster characteristics after the debris flow. The results showed that the Shuimo catchment belongs to low-frequency debris flows, with a recurrence cycle of more than 100 years and concealed features. High vegetation coverage (72%) and a long main channel (11.49 km) increase the rainfall-triggering conditions for debris flow occurrence, making it more hidden and less noticed. The Shuimo catchment has a large drainage area of 31.26 km2, 15 tributaries, significant elevation differences of 2017 m, and favorable hydraulic conditions for debris flow. The main sources of debris flow material supply are channel erosion and slope erosion, which account for 84.4% of the total material. The collapse of landslides blocking both sides of the main channel resulted in an amplification of the debris flow scale, leading to the blockage of the Baishui River. The scale of the accumulation fan is 28 × 104 m3, and the barrier lake area is 37.4 × 104 m2. The formation mechanism can be summarized as follows: rainfall triggering → shallow landslides → slope debris flow → channel erosion → landslide damming → dam failure and increased discharge → deposition and river blockage. The results of this study provide references for remote sensing emergency investigation and analysis of similar low-frequency and concealed debris flows, as well as a scientific basis for local disaster prevention and reduction.

Threats due To Side Channel Attacks (SCA) in Smartphones

Threats due To Side Channel Attacks (SCA) in Smartphones

Frequency analysis of open/closed polygonal channel aerostructures made of hybrid nanocomposite materials and supported by piecewise elastic foundation using GDQE technique

This research delves into the theoretical exploration of the generalized differential quadrature element (GDQE) method for analyzing the dynamic response and natural frequency of aerospace structures, specifically polygonal channels found in aircraft, satellites, and space vehicle components. These structures are critical in aerospace engineering, serving in various capacities such as airframe components and fluid conveyance systems. Emphasizing the practical significance of these structures, the study incorporates the influence of ground or support conditions, employing a two-parameter piecewise elastic foundation model. The investigated open or closed channels are characterized as laminated functionally graded hybrid nanocomposites, specifically denoted as FG-HNC, reinforced with Carbon nanotubes (CNTs) and Clay nanoparticles (CNP). Each composite layer is reinforced with randomly oriented and uniformly distributed tubes and particles. The homogenization of the hybrid composite domain is performed using the hierarchy Halpin-Tsai micromechanical rule. Utilizing the GDQE technique, the channels are discretized into plate elements, and motion equations for each plate element are calculated based on first-order shear deformation theory and Hamilton's principle. The resulting equations are then solved using the standard GDQ method, with subsequent application of appropriate continuity conditions at shared element boundaries. In this comprehensive study, the research scrutinizes the effects of structure dimensions, channel sides crank angles, composite characteristics, and boundary conditions on the free vibration behavior of the polygonal channels. By offering detailed insights into the vibrational characteristics of FG-HNC structures, this study contributes to the advancement of aerospace engineering design and analysis.

Timing Side-Channel Mitigation via Automated Program Repair

Side-channel vulnerability detection has gained prominence recently due to Spectre and Meltdown attacks. Techniques for side-channel detection range from fuzz testing to program analysis and program composition. Existing side-channel mitigation techniques repair the vulnerability at the IR/binary level or use runtime monitoring solutions. In both cases, the source code itself is not modified, can evolve while keeping the vulnerability, and the developer would get no feedback on how to develop secure applications in the first place. Thus, these solutions do not help the developer understand the side-channel risks in her code and do not provide guidance to avoid code patterns with side-channel risks. In this paper, we present Pendulum , the first approach for automatically locating and repairing side-channel vulnerabilities in the source code, specifically for timing side channels. Our approach uses a quantitative estimation of found vulnerabilities to guide the fix localization, which goes hand-in-hand with a pattern-guided repair. Our evaluation shows that Pendulum can repair a large number of side-channel vulnerabilities in real-world applications. Overall, our approach integrates vulnerability detection, quantization, localization, and repair into one unified process. This also enhances the possibility of our side-channel mitigation approach being adopted into programming environments.

IoT-based trusted wireless communication framework by machine learning approach

The traditional Radio-Frequency Systems (RFS) authentication methods, designed to ensure secure data transmission on the web, may not always effectively prevent adversaries from gaining access to concealed IDs or asymmetric cryptography through infiltrative, side-channel, training, and computer attacks. In contrast, Unaccounted Information (UAI) has the potential to exploit irregularities in production systems to automatically identify microchips, offering a highly robust and cost-effective security solution. This approach introduces RFS-UAI, a deep neural network-based system that efficiently manages wireless node identification by leveraging synthetic RFS characteristics of remote controls (Tx) learned through supervised methods in Wireless Sensor Networks (WSN). Unlike traditional methods that require the development of specialized transistors for UAI or semantic segmentation, this approach utilizes the existing asymmetrical RFS communication networks. Similar to the way the human brain processes information, Rx handles the entire device identification process at the gateway. According to test results, which include assessing process capability at a specified 65 nm threshold voltage and characteristics such as Local Oscillator (LO) misalignment and I-Q disparity using a probabilistic model with 52 hidden units, the system can distinguish up to 4800 transmitters with a remarkable 99.9 % accuracy under various channel conditions, all without the need for regular preambles. This recommended method can serve as a standalone security measure or be integrated into a biometric identification system.

Impact of Imbalanced Modulation on Security of Continuous-Variable Measurement-Device-Independent Quantum Key Distribution

Continuous variable measurement-device-independent quantum key distribution (CV-MDI-QKD) removes all known or unknown side-channel attacks on detectors. However, it is difficult to fully implement assumptions in the security demonstration model, which leads to potential security vulnerabilities inevitably existing in the practical system. In this paper, we explore the impact of imbalanced modulation at transmitters on the security of the CV-MDI-QKD system mainly using a coherent state and squeezed state under symmetric and asymmetric distances. Assuming two different modulation topologies of senders, we propose a generalized theoretical scheme and evaluate the key parameter achievable of the protocol with the mechanism of imbalanced modulation. The presented results show that imbalanced modulation can achieve a relatively nonlinearly higher secret key rate and transmission distances than the previous protocol which is the balanced modulation variance used by transmitters. The advantage of imbalanced modulation is demonstrated for the system key parameter estimation using numerical simulation under different situations. In addition, the consequences indicate the importance of imbalanced modulation on the performance of CV-MDI-QKD protocol and provide a theoretical framework for experimental implementation as well as the optimal modulated mode.

Efficient SFC Protection Method against Network Attack Risks in Air Traffic Information Networks

With the continuous development of the civil aviation industry toward digitalization and intelligence, the closed architecture of traditional air traffic information networks struggles to meet the rapidly growing demands for air traffic services. Network function virtualization (NFV) is one of the key technologies that can address the rigidity of traditional air traffic information networks. NFV technology has facilitated the flexible deployment of air traffic services, but it has also expanded the attack surface of the network. In addressing the network attack risks faced by service function chains (SFCs) in NFV environments, a SFC protection method based on honeypots and backup technology (PBHB) is proposed to reduce the resource cost of protecting air traffic information networks while enhancing network security. Initially, PBHB utilizes the TAPD algorithm to deploy the primary VNFs as closely as possible to the shortest path between the source and destination endpoints, thus aiming to reduce SFC latency and save bandwidth resource costs. Subsequently, the RAHDR algorithm is employed to install honeypot VNFs in each physical platform that is at risk of side-channel attacks, thus updating the deployment status of honeypot VNFs in real time based on the VNF lifecycle in order to offer primary protection for SFCs. Lastly, the BDMPE algorithm was used to calculate the backup scheme with the highest protection efficiency to implement secondary protection for the SFCs that still do not meet the security requirements. Through experiments, the maximum backup limit for SFCs in PBHB was determined, confirming its satisfactory performance across various SFC arrival rates. Furthermore, performance comparisons with other SFC protection methods revealed that PBHB achieves optimizations in resources cost while ensuring SFC security and latency.

Optimizing spiral‐wound pervaporation membrane modules through simulation: Unraveling the permeate spacer structure

AbstractFor low‐pressure pervaporation, the performance of spiral wound pervaporation membrane (SWM‐PV) module is significantly influenced by permeate spacer structure. This study addresses mass transport challenges in SWM‐PV modules, focusing on increased gas flow resistance and vacuum attenuation due to membrane envelope deformation in the permeate side channel. Employing fluid and structural simulation models to evaluate phase change and membrane deformation, we successfully optimized SWM‐PV module configurations for improved ethanol recovery. Our strategies included a mass transfer‐enhanced feed spacer to mitigate concentration polarization, a high‐strength permeate spacer to alleviate membrane deformation, and tailored membrane envelopes to balance packing density and mass transfer efficiency. These synergistic optimizations led to a 22.1% improvement in ethanol mass transfer coefficient and a 78.5% reduction in module's specific energy consumption. Our work reveals the importance of permeate spacer structure in optimizing SWM‐PV modules, offering clear guidance for the development of mass transfer‐enhanced SWM‐PV modules.

A new perspective exploration of machine learning algorithms for defending Side-Channel attacks

A new perspective exploration of machine learning algorithms for defending Side-Channel attacks

A TEMPEST Attack Implementation based on Hidden Markov model in Smart Grid

Abstract A Smart Grid contains a large number of terminals to gather voltage, current, and power data. If these terminals are attacked by hackers to steal data and disrupt the operation of the grid, the grid will encounter a huge challenge. And side channel attack is an attack way that uses information signals (such as electromagnetic radiation, and computer hardware running sound) inadvertently released by the computer to decipher. The computer keyboard generates electromagnetic radiation signals during operation, and hackers may acquire your account and password through the keyboard’s tapping sound, resulting in the leakage of important data. This article analyzes the electromagnetic radiation leakage vulnerabilities of keyboards and designs a way to implement a TEMPEST (Transient Electromagnetic Pulse Emanation Surveillance Technology) Attack based on the Hidden Markov model, which can provide a foundation for avoiding potential risk.

Physical Side-Channel Attacks against Intermittent Devices

Intermittent (batteryless) devices operate solely using energy harvested from their environment. These devices turn on when they have energy and turn off during energy scarcity. Intermittent devices have recently become increasingly popular in smart buildings, manufacturing plants, and medical implantables as they eliminate the need for battery replacement and enable green computing. Despite their growing adoption in critical applications, the privacy implications of intermittent devices remain largely unexplored. In this paper, we introduce a novel remote side-channel attack. Our observation is that the network packet frequency of an intermittent device can be exploited to learn its turn-on/off patterns. From these patterns, we can infer the energy availability of a device, which reveals privacy-sensitive information about its operating environment, e.g., the presence or absence of individuals. To realize our attack, we develop a three-stage hierarchical inference framework that leverages the timestamped network packet sequence of intermittent devices. Our framework automatically extracts a set of temporal features from inter-packet-arrival timings. It then employs a series of models to uncover (1) whether a target intermittent device is present in the environment, (2) its energy harvester type (e.g., vibration or water flow), and (3) its energy availability conditions (e.g., high-vibration or no-vibration). To validate our attack effectiveness, we conduct experiments in two environments: a smart home and a miniature manufacturing plant equipped with three intermittent devices powered by solar energy, vibration, and temperature. By analyzing their energy availability patterns, we are able to infer user activities and presence in the smart home and the robot’s movement patterns in the manufacturing plant with an average accuracy of 85%. This sensitive information enables an adversary to launch domain-specific attacks, such as burglarizing a smart home when the user is asleep or timely tampering with plant sensors to cause maximum damage.