Side-channel Information Research Articles

Side-channel information leak detection with wavelet transformation

Side-channel information leak detection with wavelet transformation

Bio-chemical Assay Locking to Thwart Bio-IP Theft

It is expected that as digital microfluidic biochips (DMFBs) mature, the hardware design flow will begin to resemble the current practice in the semiconductor industry: design teams send chip layouts to third-party foundries for fabrication. These foundries are untrusted and threaten to steal valuable intellectual property (IP). In a DMFB, the IP consists of not only hardware layouts but also of the biochemical assays (bioassays) that are intended to be executed on-chip. DMFB designers therefore must defend these protocols against theft. We propose to “lock” biochemical assays by inserting dummy mix-split operations. We experimentally evaluate the proposed locking mechanism, and show how a high level of protection can be achieved even on bioassays with low complexity. We also demonstrate a new class of attacks that exploit the side-channel information to launch sophisticated attacks on the locked bioassay.

On Non-Completeness and G-Equivariance

With the growing threat of the side-channel attack (SCA) to the cryptographic algorithm’s implementations, the masking method has become one of the most promising SCA countermeasures for securely implementing, for example, block ciphers. The basic principle of the masking method is that if the sensitive variable (which, by definition, depends on sensitive information) is split into some random variables and they are manipulated in a secure manner, then the relationship between the random variables and the corresponding side-channel information may look independent from the outside world. However, after the introduction of the glitch attack, there has been a lot of concern about the security of the masking method itself. And, to mitigate the threat of the glitch attack, the threshold implementation (TI) and G-equivariant gates were independently introduced as countermeasures. In this paper, we consider the main notions of two such independent glitch attack’s countermeasures, say, non-completeness and G-equivariance, and investigate their relationship. The contribution of this paper is three-fold. First, we show that the widely-circulated proof that the non-complete TI with uniform inputs guarantees the security against the 1st order DPA even in the presence of glitches is not satisfactory. Next, using the extended notion of G-equivariance to the higher-order setting, we prove that non-completeness implies G-equivariance, which, in turn, means that the non-complete TI with uniform inputs has resistance against the glitch attack. Thirdly, we prove that the set of non-complete gates is a proper subset of the set of G-equivariant gates by showing there is a gate that is G-equivariant but not non-complete.

Guards in action: First-order SCA secure implementations of KETJE without additional randomness

Recently the CAESAR competition has announced several finalists among the submitted authenticated encryption algorithms, after an open selection process during the last five years. Applications using these algorithms are rapidly increasing today. Devices implementing these applications are enormously susceptible to physical attacks, which are able to retrieve secret data through side-channel information such as power consumption or the electromagnetic radiations. In this work, we present a Side-Channel Analysis resistant hardware implementation of the whole family of authenticated encryption schemes Ketje. By changing just one parameter, any of the Ketje designs can be obtained, and tailored for different applications, either lightweight or high throughput.We introduce a new protected Keccak implementation, as well as unprotected and protected Ketje implementations, which allow both encryption and decryption modes in the same module. In order to secure these implementations we make use of the masking scheme known as Threshold Implementations and complement it with the technique of “Changing of the Guards”, achieving a first-order Side-Channel Analysis protected implementation with zero extra randomness needed. This way, no dedicated PRNG needs to be additionally implemented, avoiding issues such as the security of the PRNG itself or the quality of the randomness. We elaborate on the importance of the input dependencies and how the addition of linear blocks could thwart the security provided by a correctly protected module. This is of special importance when extending Keccakto implement Ketje. Furthermore, we provide an empirical evaluation of both Keccakand Ketjeimplementations, demonstrating how with our methodology we can construct a secure Ketjebased on a previously secured Keccak.

Electromagnetic Side Channel Information Leakage Created by Execution of Series of Instructions in a Computer Processor

The side-channel leakage is a consequence of program execution in a computer processor, and understanding relationship between code execution and information leakage is a necessary step in estimating information leakage and its capacity limits. This paper proposes a methodology to relate program execution to electromagnetic side-channel emanations and estimates side-channel information capacity created by execution of series of instructions (e.g., a function, a procedure, or a program) in a processor. To model dependence among program instructions in a code, we propose to use Markov source model, which includes the dependencies among sequence of instructions as well as dependencies among instructions as they pass through a pipeline of the processor. The emitted electromagnetic (EM) signals during instruction executions are natural choice for the inputs into the model. To obtain the channel inputs for the proposed model, we derive a mathematical relationship between the emanated instruction signal power (ESP) and total emanated signal power while running a program. Then, we derive the leakage capacity of EM side channels created by execution of series of instructions in a processor. Finally, we provide experimental results to demonstrate that leakages could be severe and that a dedicated attacker could obtain important information.

Verifying and Quantifying Side-channel Resistance of Masked Software Implementations

Power side-channel attacks, capable of deducing secret data using statistical analysis, have become a serious threat. Random masking is a widely used countermeasure for removing the statistical dependence between secret data and side-channel information. Although there are techniques for verifying whether a piece of software code is perfectly masked, they are limited in accuracy and scalability. To bridge this gap, we propose a refinement-based method for verifying masking countermeasures. Our method is more accurate than prior type-inference-based approaches and more scalable than prior model-counting-based approaches using SAT or SMT solvers. Indeed, our method can be viewed as a gradual refinement of a set of type-inference rules for reasoning about distribution types. These rules are kept abstract initially to allow fast deduction and then made concrete when the abstract version is not able to resolve the verification problem. We also propose algorithms for quantifying the amount of side-channel information leakage from a software implementation using the notion of quantitative masking strength. We have implemented our method in a software tool and evaluated it on cryptographic benchmarks including AES and MAC-Keccak. The experimental results show that our method significantly outperforms state-of-the-art techniques in terms of accuracy and scalability.

A Chaotic Block Cryptographic System Resistant to Power Analysis Attack

The securities of chaotic cryptographic systems are widely evaluated by conventional tests such as the character frequency test, entropy test and avalanche test. However, when the chaotic cryptosystem is in operation, side channel information such as power consumption, and electromagnetic radiation is leaked. The side channel information can be used to attack the cryptosystem, e.g. the side channel attack (SCA), which is a threat for the security of chaotic cryptographic systems. This paper proposes a chaotic block cryptographic algorithm that can resist the SCA, with the aim of enhancing the security of chaotic cryptosystems. Masking and hiding mechanisms are used in this work. By using the former, the intermediate data correlated with the plaintexts/keys are masked by random numbers, thus no direct correlation exists between the power consumption and the plaintexts/keys and the first order SCA can be counteracted. By using the latter, additional noise is added to the side channel information by randomizing the operation sequence of the algorithm. Combining these two methods, the higher order SCA can be counteracted. To evaluate the security of the proposed system, the correlation power analysis attacks are carried out based on the target device of an Atmel XMEGA microcontroller. For the proposed system, the correlation coefficient calculated from the correct key is not larger than the incorrect keys. However, for the unprotected cipher system, the correlation coefficient calculated from the correct key is 0.8 and the coefficients calculated from the incorrect keys are less than 0.5, i.e. the system can be attacked. Experimental results demonstrate that the proposed cryptosystems can counteract the correlation power analysis attacks and maintain the security performance for the chaotic cryptographic systems.

Implementation of security module to protect programme theft in microcontroller-based applications

ABSTRACTSource code plagiarism has become a serious threat for the development of small scale embedded industries and also the violations of intellectual property right are a threat for the development of hardware system. There are many software solutions for comparing source codes, but they are often not realistic in the present scenario. Digital watermarking scheme is one of the possible solutions for this problem. A novel watermarking technique is employed so that it can be easily and reliably detected by special techniques. In this paper, verification methods are presented to detect software plagiarism in the embedded application software without the implemented source code. All the approaches use side-channel information obtained during the execution of the suspicious code. The primary method is passive, i.e. no previous modification of the original code is required. It determines that the Hamming weights of the executed instructions of the suspicious device are used and uses string matching algorithms for comparisons with a reference implementation. The other method inserts additional code fragments as a watermark that can be identified in the power consumption of the executed source code. Proposed approaches are robust against code-transformation attacks.

Power analysis attack against encryption devices: a comprehensive analysis of AES, DES, and BC3

Cryptography is a science of creating a secret message and it is constantly developed. The development consists of attacking and defending the cryptography itself. Power analysis is one of many Side-Channel Analysis (SCA) attack techniques. Power analysis is an attacking technique that uses the information of a cryptographic hardware’s power consumption. Power analysis is carried on by utilizing side-channel information to a vulnerability in a cryptographic algorithm. Power analysis also uses a mathematical model to recover the secret key of the cryptographic device. This research uses design research methodology as a research framework started from research clarification to descriptive study. In this research, power analysis attack is implemented to three symmetrical cryptographic algorithms: DES (Data Encryption Standard), AES (Advanced Encryption Standard), and BC3 (Block Cipher 3). The attack has successfully recovered 100% of AES secret key by using 500 traces and 75% DES secret key by using 320 traces. The research concludes that the power analysis attack using Pearson Correlation Coefficient (PCC) method produces more optimal result compared to a difference of means method.

Towards Thwarting Template Side-channel Attacks in Secure Cloud Deduplications

As one of a few critical technologies to cloud storage service, deduplication allows cloud servers to save storage space by deleting redundant file copies. However, it often leaks side channel information regarding whether an uploading file gets deduplicated or not. Exploiting this information, adversaries can easily launch a template side-channel attack and severely harm cloud users' privacy. To thwart this kind of attack, we resort to the k-anonymity privacy concept to design secure threshold deduplication protocols. Specifically, we have devised a novel cryptographic primitive called “dispersed convergent encryption” (DCE) scheme, and proposed two different constructions of it. With these DCE schemes, we successfully construct secure threshold deduplication protocols that do not rely on any trusted third party. Our protocols not only support confidentiality protections and ownership verifications, but also enjoy formal security guarantee against template side-channel attacks even when the cloud server could be a “covert adversary” who may violate the predefined threshold and perform deduplication covertly. Experimental evaluations show our protocols enjoy very good performance in practice.

CC Meets FIPS: A Hybrid Test Methodology for First Order Side Channel Analysis

Common Criteria (CC) and FIPS 140-3 are two popular side channel testing methodologies. Test Vector Leakage Assessment Methodology ( TVLA ), a potential candidate for FIPS, can detect the presence of side-channel information in leakage measurements. However, TVLA results cannot be used to quantify side-channel vulnerability and it is an open problem to derive its relationship with side channel attack success rate ( SR ), i.e., a common metric for CC. In this paper, we extend the TVLA testing beyond its current scope. Precisely, we derive a concrete relationship between TVLA and signal to noise ratio ( SNR ). The linking of the two metrics allows direct computation of success rate ( SR ) from TVLA for given choice of intermediate variable and leakage model and thus unify these popular side channel detection and evaluation metrics. An end-to-end methodology is proposed, which can be easily automated, to derive attack SR starting from TVLA testing. The methodology works under both univariate and multivariate setting and is capable of quantifying any first order leakage. Detailed experiments have been provided using both simulated traces and real traces on SAKURA-GW platform. Additionally, the proposed methodology is benchmarked against previously published attacks on DPA contest v4.0 traces, followed by extension to jitter based countermeasure. The result shows that the proposed methodology provides a quick estimate of SR without performing actual attacks, thus bridging the gap between CC and FIPS.

Leaking your engine speed by spectrum analysis of real-Time scheduling sequences

Abstract This paper identifies and studies a new security/privacy issue for automobile vehicles. Specifically, attackers can infer the engine speed of a vehicle by observing and analyzing the real-time scheduling sequences on the Engine Control Unit (ECU). First, we present the problem model of engine-triggered task executed on ECU. And then, we introduce two Engine-triggered Task Period Tracing methods (DFT-based ETPT and FRSP-based ETPT) to infer the period variation of engine-triggered task. Finally, simulation experiments are conducted to demonstrate the effect of this new timing side-channel information leakage with our proposed methods.

Location Privacy in Usage-Based Automotive Insurance: Attacks and Countermeasures

Usage-based insurance (UBI) is regarded as a promising way to provide accurate automotive insurance rates by analyzing the driving behaviors (e.g., speed, mileage, and harsh braking/accelerating) of drivers. The best practice that has been adopted by many insurance programs to protect users’ location privacy is the use of driving speed rather than GPS data. However, in this paper, we challenge this approach by presenting a novel speed-based location trajectory inference framework. The basic strategy of the proposed inference framework is motivated by the following observations. In practice, many environmental factors, such as real-time traffic and traffic regulations, can influence the driving speed. These factors provide side-channel information about the driving route, which can be exploited to infer the vehicle’s trace. We implement our discovered attack on a public data set in New Jersey. The experimental results show that the attacker has a nearly 60% probability of obtaining the real route if he chooses the top 10 candidate routes. To thwart the proposed attack, we design a privacy preserving scoring and data audition framework that enhances drivers’ control on location privacy without affecting the utility of UBI. Our defense framework can also detect users’ dishonest behavior (e.g., modification of speed data) via a probabilistic audition scheme. Extensive experimental results validate the effectiveness of the defense framework.

IPA: an Instruction Profiling–Based Micro-architectural Side-Channel Attack on Block Ciphers

Hardware performance counters (HPCs) are present in most modern processors and provide an interface to user-level processes to monitor their performance in terms of the number of micro-architectural events, executed during the process execution. In this paper, we analyze the leakage from these HPC events and present a new micro-architectural side-channel attack that observes the number of instruction counts during the execution of an encryption algorithm as side-channel information to recover the secret key. This paper explores the fact that the instruction counts can act as a side channel and then describes the instruction profiling attack (IPA) methodology with the help of two block ciphers, namely AES and CLEFIA, on Intel and AMD processors. We follow the principles of profiled instruction attacks and show that the proposed attack is more potent than the well-known cache timing attacks in literature. We also perform experiments on ciphers implemented with popular time fuzzing schemes to subvert timing attacks. Our results show that while the countermeasure successfully stops leakages through the timing channels, it is vulnerable to the instruction profiling attack. We validate our claims by detailed experiments on contemporary Intel and AMD platforms to demonstrate that seemingly benign instruction counts can serve as side channels even for block cipher implementations that are hardened against timing attacks. In addition to it, we present detailed experimentation to analyze the rationale behind the attack and also explore the performance of IPA on a countermeasure designed to subvert the cache-based attacks considering a case study on CLEFIA.

Inference attack in Android Activity based on program fingerprint

Private breach has always been an important threat to mobile security. Recent studies show that an attacker can infer users' private information through side channels, such as the use of runtime memory and network usage. For side-channel attacks, malicious applications generally run parallel in the background with a foreground application and stealthily collect side-channel information. In this paper, we analyze the relationship between memory changes and Activity transition, then use side-channel information to label an Activity and build an Activity signature database. We show how to use the runtime memory exposure to infer the Activity transition of the current application and use other side channels to infer its Activity interface. We demonstrate the effectiveness of the attacks with 5 popular applications that contain user sensitive information, and successfully inferred most of the Activity transition and Activity interface process. Moreover, we propose a protection scheme which can effectively resist side-channel attacks.

Revealing Privacy Vulnerabilities of Anonymous Trajectories

The proliferation of various mobile devices equipped with GPS positioning modules makes the collection of trajectories more easier than ever before, and more and more trajectory datasets have been available for business applications or academic researches. Normally, published trajectories are often anonymized by replacing real identities of mobile objects with pseudonyms (e.g., random identifiers); however, privacy leaks can hardly be prevented. In this paper, we introduce a novel paradigm of de-anonymization attack re-identifying trajectories of victims from anonymous trajectory datasets. Different from existing attacks, no background knowledge or side channel information about the target dataset is required. Instead, we claim that, for each moving object, there exist some mobility patterns that reflect the preference or usual behavior of the object, and will not change dramatically over a period of time. As long as those relatively stable patterns can be extracted from trajectories and be utilized as quasi-identifiers, trajectories can be linked to anonymous historical ones. To implement such kind of de-anonymization attacks, an adversary only needs to collect a few trajectory segments of a victim, the durations of which do not necessarily overlap with that of trajectories in the target dataset (in simple terms, those trajectory segments are not necessary sub-trajectories included in the target dataset). Since the movements of victims in public areas could be observed openly, an adversary can obtain traces or locations about the victims either by direct monitoring them (e.g., tracking) or from third parties (e.g., social-networks). Then, the adversary extracts useful patterns from both the historical trajectories in the accessible dataset and newly obtained trajectory segments of victims, the historical trajectory with most similar patterns to that of a victim is considered as belonging to the victim. In order to demonstrate the feasibility of such attacks, we conduct extensive trace-driven simulations. We extract road segment preferences and stop of interests from trajectories of vehicles, and construct feature vectors (mobility patterns) of vehicles according to them, used for trajectory comparisons. Simulation results show that the adversary could re-identify anonymous trajectories effectively.

Error Amplification in Code-based Cryptography

Code-based cryptography is one of the main techniques enabling cryptographic primitives in a post-quantum scenario. In particular, the MDPC scheme is a basic scheme from which many other schemes have been derived. These schemes rely on iterative decoding in the decryption process and thus have a certain small probability p of having a decryption (decoding) error.In this paper we show a very fundamental and important property of code-based encryption schemes. Given one initial error pattern that fails to decode, the time needed to generate another message that fails to decode is strictly much less than 1/p. We show this by developing a method for fast generation of undecodable error patterns (error pattern chaining), which additionally proves that a measure of closeness in ciphertext space can be exploited through its strong linkage to the difficulty of decoding these messages. Furthermore, if side-channel information is also available (time to decode), then the initial error pattern no longer needs to be given since one can be easily generated in this case.These observations are fundamentally important because they show that a, say, 128- bit encryption scheme is not inherently safe from reaction attacks even if it employs a decoder with a failure rate of 2−128. In fact, unless explicit protective measures are taken, having a failure rate at all – of any magnitude – can pose a security problem because of the error amplification effect of our method.A key-recovery reaction attack was recently shown on the MDPC scheme as well as similar schemes, taking advantage of decoding errors in order to recover the secret key. It was also shown that knowing the number of iterations in the iterative decoding step, which could be received in a timing attack, would also enable and enhance such an attack. In this paper we apply our error pattern chaining method to show how to improve the performance of such reaction attacks in the CPA case. We show that after identifying a single decoding error (or a decoding step taking more time than expected in a timing attack), we can adaptively create new error patterns that have a much higher decoding error probability than for a random error. This leads to a significant improvement of the attack based on decoding errors in the CPA case and it also gives the strongest known attack on MDPC-like schemes, both with and without using side-channel information.

A 286 F2/Cell Distributed Bulk-Current Sensor and Secure Flush Code Eraser Against Laser Fault Injection Attack on Cryptographic Processor

Laser fault injection (LFI) attack on cryptographic processors is a serious threat to information security. This paper proposes a sense-and-react countermeasure against LFI. A distributed bulk-current sensor monitors the abnormal current conduction caused by laser irradiation to a silicon substrate. The single sensor occupies only 286 F2/Cell and it is distributed across the entire cryptographic core for 100% attack detection coverage. Upon detection of LFI attack, a flush code eraser prevents a leakage of faulty ciphertext by immediately shunting the core supply path within nano-second order. In addition, the core supply during the shunting is electrically isolated from the global supply line to prevent side-channel information leakage of intermediate faulty codes. A test chip was designed and fabricated in 0.18- $\mu \text{m}$ standard CMOS, integrating a 128-bit Advanced Encryption Standard (AES) cryptographic processor with the proposed countermeasures. A protected AES processor can disable LFI attack with only +28% layout area penalty compared to an unprotected core.

Feed-Forward Back-Propagation Neural Networks in Side-Channel Information Characterization

The safety of cryptosystems, mainly based on algorithmic improvement, is still vulnerable to side-channel attacks (SCA) based on machine learning. Multi-class classification based on neural networks and principal components analysis (PCA) can be powerful tools for pattern recognition and classification of side-channel information. In this paper, an experimental investigation was conducted to explore the efficiency of various architectures of feed-forward back-propagation (FFBP) neural networks and PCA against side-channel attacks. The experiment is performed on the data leakage of an FPGA implementation of elliptic curve cryptography (ECC). Our results show that the proposed method is a promising method for SCA with an overall accuracy of 88% correct classification.

Comprehensive Evaluation on an ID-Based Side-Channel Authentication with FPGA-Based AES

Various electronic devices are increasingly being connected to the Internet. Meanwhile, security problems, such as fake silicon chips, still exist. The significance of verifying the authenticity of these devices has led to the proposal of side-channel authentication. Side-channel authentication is a promising technique for enriching digital authentication schemes. Motivated by the fact that each cryptographic device leaks side-channel information depending on its used secret keys, cryptographic devices with different keys can be distinguished by analyzing the side-channel information leaked during their calculation. Based on the original side-channel authentication scheme, this paper adapts an ID-based authentication scheme that can significantly increase the authentication speed compared to conventional schemes. A comprehensive study is also conducted on the proposed ID-based side-channel authentication scheme. The performance of the proposed authentication scheme is evaluated in terms of speed and accuracy based on an FPGA-based AES implementation. With the proposed scheme, our experimental setup can verify the authenticity of a prover among 2 70 different provers within 0.59 s; this could not be handled effectively using previous schemes.