Side-channel Research Articles

A Systematic Deconstruction of Human-Centric Privacy & Security Threats on Mobile Phones

Mobile phones are most likely the subject of targeted attacks, such as software exploits. The resources needed to carry out such attacks are becoming increasingly available and, hence, easily executable, putting users’ privacy at risk. We conducted a systematic literature analysis to understand the relationship between resources and attack feasibility and present a categorisation of social engineering and side-channel attacks on mobile phones focusing on the resources attackers require. Our proposed categorisation levels facilitate an in-depth understanding of how mobile phone attacks can be executed using different combinations of partly simple resources. The analysis reveals that discrete protection mechanisms are insufficient to provide all-inclusive protection. The proposed categorisation assists in building novel solutions for safeguarding users’ privacy from diverse attacks by carefully considering the potential misuse of resources. We conclude by outlining future research directions highlighting the urgent need for a holistic user defense.

The where and why of large wood occurrence in the Upper Mississippi and Illinois Rivers

AbstractLarge wood (LW) plays important geomorphic and ecological roles in rivers and is widely used as a restoration tool. Changes to floodplain land use and historical removal have altered wood dynamics in fluvial systems globally. We know little about the distribution and dynamics of LW in great rivers (approximately >105 km2) like the Upper Mississippi and Illinois Rivers despite its ecosystem importance and use in restoration projects. We assessed LW occurrence data collected by the fisheries component of the Upper Mississippi River Restoration Program's Long Term Resource Monitoring element. We analysed 25 years of data collected across six reaches of the Upper Mississippi and Illinois Rivers that represented contrasting physiographic settings, and across four aquatic area types comprising gradients of hydrology, connectivity and geomorphology. We tested hypotheses on drivers of LW occurrence using generalised linear mixed effects models, where occurrence was predicted by reach‐ and local‐scale environmental variables. Occurrence varied significantly across reaches and aquatic area types. In general, wood occurred more frequently upriver and in side channels compared to other aquatic areas. Large wood was most strongly predicted systemically by reach identity but not local‐scale variables, underscoring the importance of broad‐scale physiographic gradients in defining hydrogeomorphic processes. Floodplain forests and shoreline revetment were consistently important predictors across reaches. Our findings show that the spatial variability of LW occurrence reflects the physical variability of the Upper Mississippi and Illinois Rivers. They also reveal the value in using geomorphic classifications as frameworks for understanding physical processes like LW dynamics because of their ability to contextualise site‐scale conditions. The baseline understanding of LW abundance across different hydrogeomorphic gradients and scales presented here can give insight into how to more effectively target restoration efforts in great rivers and contribute to a broader understanding of LW dynamics where such studies have been lacking.

Lightweight Hardware-Based Cache Side-Channel Attack Detection for Edge Devices (Edge-CaSCADe)

Cache Side-Channel Attacks (CSCAs) have been haunting most processor architectures for decades now. Existing approaches to mitigation of such attacks have certain drawbacks, namely software mishandling, performance overhead, and low throughput due to false alarms. Hence, “mitigation only when detected” should be the approach to minimize the effects of such drawbacks. We propose a novel methodology of fine-grained detection of timing-based CSCA using a hardware-based detection module. We discuss the design, implementation, and use of our proposed detection module in processor architectures. Our approach successfully detects attacks that flush secret victim information from cache memory like Flush+Reload, Flush+Flush, Prime+Probe, Evict+Probe, and Prime+Abort, commonly known as cache timing attacks. Detection is on time with minimal performance overhead. The parameterizable number of counters used in our module allows detection of multiple attacks on multiple sensitive locations simultaneously. The fine-grained nature ensures negligible false alarms, severely reducing the need for any unnecessary mitigation. The proposed work is evaluated by synthesizing the entire detection algorithm as an attack detection block, Edge-CaSCADe, in a RISC-V processor as a target example. The detection results are checked under different workload conditions with respect to the number of attackers and the number of victims having RSA-, AES-, and ECC-based encryption schemes like ECIES, and on benchmark applications like MiBench and Embench. More than 98% detection accuracy within 2% of the beginning of an attack can be achieved with negligible false alarms. The detection module has an area and power overhead of 0.9% to 2% and 1% to 2.1% for the targeted RISC-V processor core without cache for one to five counters, respectively. The detection module does not affect the processor critical path and hence has no impact on its maximum operating frequency.

Experimental Investigation of Side-Channel Attacks on Neuromorphic Spiking Neural Networks

Experimental Investigation of Side-Channel Attacks on Neuromorphic Spiking Neural Networks

Nowhere to Hide: Monitoring Side Channels for Supply Chain Resiliency

Nowhere to Hide: Monitoring Side Channels for Supply Chain Resiliency

Joint Eavesdropping on the BB84 Decoy State Protocol with an Arbitrary Passive Light-source Side Channel

Joint Eavesdropping on the BB84 Decoy State Protocol with an Arbitrary Passive Light-source Side Channel

Application of BPNN algorithm in thermal-hydraulic analysis of unwrapped LFR core

Due to the complex structure of the LFR fuel rod bundle, refined CFD simulation consumes significant computing resources and time, making it difficult to meet the immediate needs of engineering design and research. This paper introduces a method that integrates the sub-channel level thermal-hydraulic analysis code CorTAF-LBE with the BPNN algorithm to analyze the thermal-hydraulic phenomena within the LFR core. The method has been validated by refined simulation results of the THEADES test section, which indicate that the error is within an acceptable range. The feasibility of its application in LFR fuel assemblies was also evaluated. The flow characteristics and temperature distribution in unwrapped LFR rod bundles are investigated. Due to differences in fuel distribution and flow area, the temperature in the central channel is much higher than that in the side and trapezoidal channels. Three accident conditions, including inlet blockage, center blockage, and outlet blockage, were simulated. The corresponding peak temperatures of the fuel cladding were 670 K, 767 K, and 860 K, respectively, representing an increase of approximately 170 K compared to the nominal conditions. The analysis results effectively demonstrate the 3D temperature distribution of the fluid in the rod bundles, which is significant for reactor design and safety analysis of LFRs.

Security of the Secp256k1 Elliptic Curve used in the Bitcoin Blockchain

The article delves into the intricate characteristics and security properties of the secp256k1 elliptic curve used for the generation of addresses in the Bitcoin blockchain. The Bitcoin blockchain is a decentralized digital ledger that records all transactions made with Bitcoin cryptocurrency. In this work, the secp256k1 elliptic curve and its parameters and the method of generating private and public keys using random numbers are described. While the private key allows for the signing of transactions to spend Bitcoin, the corresponding public key and address enable others to verify transactions and send funds to that specific address on the blockchain, ensuring security, authenticity, and privacy in the decentralized network. The attacks on the use of secp256k1 for generating the bitcoin addresses like the Brute force attack, twist attack, fault attacks, and side channel attacks in the implementation of the elliptic curve are discussed. By maintaining the security and integrity of secp256k1, we can ensure that cryptographic operations, such as digital signatures and key exchanges, remain uncompromised. If the curve's security were compromised, malicious users could potentially derive private keys from public keys, leading to unauthorized transactions, double-spending, or other malicious activities. The security of implementation can be enhanced by ensuring cryptographic libraries and software implementations that utilize secp256k1 undergo thorough testing and validation to ensure correct and secure operations. The important attacks on blockchain technology like the 51% attack, Sybil attack, Double Spending attack, and Smart Contract vulnerabilities are discussed. Through a comprehensive exploration, readers will gain insights into why this particular elliptic curve was chosen for use in Bitcoin's cryptographic protocols, highlighting its role in ensuring the robustness and integrity of the blockchain ecosystem.

Defence against Side-Channel Attacks for Encrypted Network Communication Using Multiple Paths

As more network communication is encrypted to provide data privacy for users, attackers are focusing their attention on traffic analysis methods for side-channel attacks on user privacy. These attacks exploit patterns in particular features of communication flows such as interpacket timings and packet sizes. Unsupervised machine learning approaches, such as Hidden Markov Models (HMMs), can be trained on unlabelled data to estimate these flow attributes from an exposed packet flow, even one that is encrypted, so it is highly feasible for an eavesdropper to perform this attack. Traditional defences try to protect specific side channels by modifying the packet transmission for the flow, e.g., by adding redundant information (padding of packets or use of junk packets) and perturbing packet timings (e.g., artificially delaying packet transmission at the sender). Such defences incur significant overhead and impact application-level performance metrics, such as latency, throughput, end-to-end delay, and jitter. Furthermore, these mechanisms can be complex, often ineffective, and are not general solutions—a new profile must be created for every application, which is an infeasible expectation to place on software developers. We show that an approach exploiting multipath communication can be effective against HMM-based traffic analysis. After presenting the core analytical background, we demonstrate the efficacy of this approach with a number of diverse, simulated traffic flows. Based on the results, we define some simple design rules for software developers to adopt in order to exploit the mechanism we describe, including a critical examination of existing communication protocol behavior.

Reviewing War: Unconventional User Reviews as a Side Channel to Circumvent Information Controls

Reviewing War: Unconventional User Reviews as a Side Channel to Circumvent Information Controls

Effects of bag characteristics and channel side slope on incipient motion of a single Geobag under river current loading

Geobag stability has not been extensively studied under river current loading. In this study, the impacts of geobag characteristics (shape, bag material, and fill ratio of sand) and channel side slope (flat and 1V:2H) on a single geobag's stability were systematically investigated in a physical model to form the solid foundation for the research of group geobags. Overall, a geobag with a higher fill ratio, combined with the more flexible cloth material, was found to be the most stable. Critical Shields parameters were estimated between 0.0018 and 0.019, and the cross-sectional averaged flow velocity at incipient motion ranged from 0.49 m/s to 1.08 m/s. A shape factor was introduced to better describe the relationship between geobag characteristics and their stability on both riverbed configurations. Both the fill ratio and the bed side slope had higher importance on the geobag's stability compared to the relative depth, bag shape, and angle of flexibility.

Declining geomorphic diversity and potential adaptive management opportunities on a highly regulated reach of the Bighorn River, Montana

ABSTRACT Rivers downstream from dams often experience decreased flow variability and disrupted sediment transport. We investigated a highly regulated 35.5-kilometre reach of the Bighorn River, downstream from Yellowtail Dam, emplaced in 1965. This dam created a thriving trout fishery, but more recently, side channel networks and habitat diminished. We document how the Bighorn River's anabranching morphology responded to flow regulation and a near cessation of sediment supply. Geomorphic diversity drastically decreased since 1939 and the Bighorn River abandoned numerous side channels. By 1980, geomorphic loss slowed, and the river became laterally static. The 1980 river and side channel network could represent the maximum areal extent of a downscaled morphology, maintained through restoration and adaptive management. However, side channel restoration alone will not return natural alluvial processes to this river reach. The Bighorn River needs sediment to reinstate dynamic lateral movement, even within a downscaled morphology. Sediment augmentation is an option, but more complex to implement on rivers where potential downstream impacts and landowners must be considered. The decline of geomorphic diversity and potential adaptive management solutions on the Bighorn River has wide applicability to numerous dammed rivers, where similar changes to the flow and sediment transport regime are common.

Side-channel attack–resistant PRESENT cipher by versatile key scheduling and compact S-box utilizing optimized three-phase logic design

The most widely used technology at the moment is the Internet of Things (IoT), which is expanding at a rapid pace because it allows us to remotely control and manage a variety of smart devices and relieves us from our demanding daily routines. Technology is also vulnerable to security breaches, as evidenced by the rise in cybercrimes and identity theft. More so than any other known IoT security breach, side-channel analysis is extremely insecure. A current issue for lightweight IoT applications is differential power analysis, a kind of side-channel analysis that is very accurate in obtaining the secret key. As a result, developing a safe style takes more time and effort. PRESENT is an easy-to-use, low-power encryption algorithm that is based on Advanced Encryption Standard (AES) and is utilized in IoT devices like RFID tags and access cards. Even with the plethora of countermeasures proposed in the last ten years, none are able to keep up with the IoT’s rapid expansion. A clever combination of masking and hiding techniques could stop several security breaches. Masked three-phase dual rail pre-charge logic is a new hybrid countermeasure that thwarts combined side-channel attacks and is suggested as a means of attaining the necessary degree of security. The hybrid design utilized in PRESENT resulted in an increase in complexity and required more work in terms of area and power. Consequently, more PRESENT optimization techniques are applied. Additionally, for PRESENT hardware implementation, a flexible key scheduling structure with parallel input and output is proposed. Using the Cadence Virtuoso simulation tool with 180-nm technology, a secured structure combining optimized algorithm and secured logic is designed, and the outcomes are analyzed. Normalized energy deviation (NED)/normalized standard deviation (NSD) analysis and Pearson correlation are used to analyze safety. The simulation results for the gates show that our proposed logic has the lowest values of NED and NSD at the assigned frequencies. When compared with side-channel analysis, the outcomes have shown to be both safe and effective. In comparison to earlier designs, the suggested system’s area and power consumption are cut by 67% and 64%, respectively.

Stimulation of Biological Structures on the Nanoscale Using Interfaces with Large Built-In Spontaneous Polarizations.

The electric potential stimulation of biological structures in aqueous environments is well-known to be a result of the gating of voltage-gated ion channels. Such voltage-gated ion channels are ubiquitous in the membranes of a wide variety of cells and they play central roles in a wide variety of sensing mechanisms and neuronal functions in biological systems. Experimental studies of ion-channel gating are frequently conducted using path-clamp techniques by placing a cumbersome external electrode in the vicinity of the extracellular side of the ion channel. Recently, it has been demonstrated that laser-induced polarization of nanoscale quantum dots can produce voltage sufficient to gate voltage-gated ion channels. This study specifically focuses on a new method of gating voltage-gated ion channels using 2D structures made of materials exhibiting large naturally occurring spontaneous polarizations, thereby eliminating the need for an external electrode or an illuminating laser. The work presents the use of self-polarizing semiconductor flakes, namely, 2H-SiC, ZnO, and GaN, to produce electric potential that is sufficient to gate voltage-gated ion channels when existing in proximity to it.

PPG-Hear: A Practical Eavesdropping Attack with Photoplethysmography Sensors

Photoplethysmography (PPG) sensors have become integral components of wearable and portable health devices in the current technological landscape. These sensors offer easy access to heart rate and blood oxygenation, facilitating continuous long-term health monitoring in clinic and non-clinic environments. While people understand that health-related information provided by PPG is private, no existing research has demonstrated that PPG sensors are dangerous devices capable of obtaining sensitive information other than health-related data. This work introduces PPG-Hear, a novel side-channel attack that exploits PPG sensors to intercept nearby audio information covertly. Specifically, PPG-Hear exploits low-frequency PPG measurements to discern and reconstruct human speech emitted from proximate speakers. This technology allows attackers to eavesdrop on sensitive conversations (e.g., audio passwords, business decisions, or intellectual properties) without being noticed. To achieve this non-trivial attack on commodity PPG-enabled devices, we employ differentiation and filtering techniques to mitigate the impact of temperature drift and user-specific gestures. We develop the first PPG-based speech reconstructor, which can identify speech patterns in the PPG spectrogram and establish the correlation between PPG and speech spectrograms. By integrating a MiniRocket-based classifier with a PixelGAN model, PPG-Hear can reconstruct human speech using low-sampling-rate PPG measurements. Through an array of real-world experiments, encompassing common eavesdropping scenarios such as surrounding speakers and the device's own speakers, we show that PPG-Hear can achieve remarkable accuracy of 90% for recognizing human speech, surpassing the current state-of-the-art side-channel eavesdropping attacks using motion sensors operating at equivalent sampling rates (i.e., 50Hz to 500Hz).

Challenges and opportunities on the horizon of post-quantum cryptography

Large quantum computers have the potential to break many cryptographic systems, e.g., Rivest–Shamir–Adleman, Diffie–Hellman key exchange, and the elliptical curve cryptosystem. The Department of Defense (DoD) is aware of this threat, and the National Institute of Standards and Technology is preparing a set of approved encryption and signature schemes that are not susceptible to these attacks by quantum computers, the so-called Post-Quantum Cryptography (PQC). The task of substituting older encryption and signature schemes raises a number of questions, to which there are not yet clear answers. In this research, we investigate the transition to PQC on existing networks, explain the approved PQC schemes, describe the likely path to an adaptation of PQC, and offer forward guidance on challenges and threats that may be encountered in the process of transition to PQC. This paper discusses the impacts of the new PQC schemes on network performance and speculates on possible side-channel attacks on the new encryption scheme. This paper offers hardware/software solutions based on the Split-protocol.

Edwards curve digital signature algorithm for video integrity verification on blockchain framework

Within the field of forensic science, video integrity is an essential component that ensures the validity and dependability of visual evidence that is essential for court cases. Maintaining the integrity of justice in a time when digital modification tools are easily accessible requires making sure that video recordings are unaltered. Video footage is carefully inspected by forensic analysts who use advanced tools to look for indications of manipulation or change. This paper presents a novel, lightweight approach for verifying the integrity of video data. The proposed method utilizes the blockchain and the Edwards Curve Digital Signature Algorithm, coupled with the BLAKE2b hash function. Signatures are generated for video clips with a predetermined size called video segments and stored in blocks chronologically. The signature of the previous block is stored in the current block to add another layer of security. At the time of validation, these signatures are verified. Experimental results show that the proposed method outperforms state-of-the-art methods in both speed and security. Our method is capable of identifying any type of forgery on any video file, by anyone, at any given moment, with insignificant additional storage requirements. Furthermore, our security analysis shows that our method is resilient against various types of attacks, including collision attacks, key substitution attacks, side-channel attacks, and chosen message attacks. The proposed lightweight video integrity verification method is better suited for use in resource constrained devices.

MS-LW-TI: Primitive-Based First-Order Threshold Implementation for 4 × 4 S-boxes

Threshold implementation (TI) is a lightweight countermeasure against side-channel attacks when glitches happen. As to masking schemes, an S-box is the key part to protection. In this paper, we propose a general first-order lightweight TI scheme for 4 × 4 S-boxes and name it as MiniSat-lightweight-threshold implementation (MS-LW-TI). First, we use MiniSat to optimally decompose an S-box into the least number of three different logic gate operations, AND, OR, and XOR. Among these operations, we define two primitives and the extension of two primitives for TI design. Furthermore, we prove that the primitives and their extensions strictly comply with the security properties. Finally, we implement MS-LW-TI on Xilinx Spartan-6 Field Programmable Gate Array (FPGA) to show that the S-boxes of PRESENT, GIFT, and PICCOLO consume only 17, 15, and 13 look-up-tables (LUTs), 16, 9, and 16 flip-flops (FFs), 6, 5, and 6 slices, respectively. Compared with the existing lightweight TI design, our TI for PRESENT S-box has a 22%, 38%, and 25% reduction of LUTs, FFs, and slices to the design by Shahmirzadi and Moradi at IACR Transactions on Cryptographic Hardware and Embedded Systems (TCHES) 2021, and our TI for GIFT S-box has a 6%, 25%, and 28% reduction of LUTs, FFs, and slices to the design by Jati et al., which is the smallest.

Structure analysis of double comb about jet spinning machine based on CFD

PurposeAs a new type of spinning machine, the jet spinning machine absorbs the carding system of the rotating cup spinning series and the nozzle part of the jet spinning. This paper aims to intends to introduce the double carding structure currently studied by the rotating cup spinning into the jet spinning machine, and analyze the influence of the nozzle characteristic number on the flow field in the double carding structure to verify the advantages of the double carding structure.Design/methodology/approachThe simulation is used to evaluate the performance of single/double split jet spinning and nozzle feature number, verify the technical advantages of double split jet spinning and evaluate the influence of nozzle feature number on flow field. The influence of the nozzle characteristic number on the flow pattern in the four models is compared. The advantages and disadvantages of a conventional single comb and a double comb with a bypass channel on the longer side of the transport channel as an additional air supply channel are also evaluated.FindingsAt present, the double comb technology of rotary cup spinning is being studied at home and abroad to improve the spinning quality and improve the difficult problem of mixed yarn with large difference in processing fiber properties. At present, the jet spinning machine combines the advantages of rotary cup spinning and jet spinning, absorbing the comb system of rotary cup spinning series and the nozzle part of jet spinning. Therefore, it is found that the introduction of the double-split structure into the wool jet spinning has research value to improve the spinning quality.Originality/valueThe purpose of this paper is to refer to the previous research on the double comb structure in rotary spinning, and to apply the double comb structure in the new jet spinning machine to improve the spinning quality. The simulation is used to evaluate the performance of single/double split jet spinning and nozzle feature number, verify the technical advantages of double split jet spinning and evaluate the influence of nozzle feature number on flow field.

Hardware/Software Cooperative Design Against Power Side-Channel Attacks on IoT Devices

Hardware/Software Cooperative Design Against Power Side-Channel Attacks on IoT Devices