Source Of Information Leakage Research Articles

There’s Always a Bigger Fish: A Clarifying Analysis of a Machine-Learning-Assisted Side-Channel Attack

<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Machine learning has made it possible to mount powerful attacks through side channels that are otherwise challenging to exploit. However, due to the black-box nature of machine learning models, these attacks can be difficult to interpret correctly. Models that simply find correlations cannot be used to analyze the various sources of information leakage behind an attack. This article highlights the limitations of relying on machine learning for side-channel attacks without completing a comprehensive security analysis. We show that a state-of-the-art website-fingerprinting attack powered by machine learning was only partially analyzed. Its authors were misled into believing their attack exploited a cache-based side channel, when it actually exploited an interrupt-based side channel. We demonstrate this through a comprehensive analysis, in which we run controlled experiments to rule out alternative hypotheses about the attack’s primary source of leakage, and ultimately instrument the attack’s code to prove our hypothesis.</i>

ПРИМЕНЕНИЕ АСИНХРОННЫХ СХЕМ ДЛЯ ПОВЫШЕНИЯ ЗАЩИТЫ ОТ АТАК ПО СТОРОННИМ КАНАЛАМ

The aim of this study is to analyze the use of asynchronous circuits to improve the security of information systems against side-channels attacks, which are means of obtaining unauthorized access to confidential data and performing unauthorized actions in the system. Side-channels attacks are fundamentally different as compared with a cryptographic analysis and an exploitation of software errors in their focus on the hardware of the system under attack. Integrated circuits unintentionally create electromagnetic signals during their operation and have a number of performance characteristics that can be investigated by an attacker and therefore become the sources of information leakage, i.e., side-channels. The security of modern information systems cannot be fully ensured without increasing resistance to such attacks. One of the methods to counter side-channel attacks is the use of asynchronous circuits, which main distinguishing feature is the refusal from the use of a global clock signal to synchronize individual elements of an integrated circuit in favour of local synchronization provided by the "handshake" mechanism. Integrated circuits designed using asynchronous circuitry have a number of unique benefits that make it possible to effectively resist side-channel attacks, such as timing attacks and attacks with using power consumption analysis. This paper presents a classification of side-channels attacks, describes asynchronous circuits and their properties that increase their resistance to certain types of side-channels attacks, and provides examples that clearly show the increase in the protection of information systems with the asynchronous circuits.

Prevention of information leakage through channels of spurious electromagnetic radiation and interference: research models

Problem statement. The investigation the currently used methods for determining the sources of information leakage threats from the basic hardware and systems (BHaS) through the spurious electromagnetic radiation and interference (SERaB) channels on the object of informatization (OoI), gives grounds to assert that they have a number of disadvantages. The lack of а formal interpretation for process dynamics of the SERaB information collecting and implementing measures to prevent information leakage requires development of a systematic approach to improving the ways and means of protecting confidential information from leakage through SERaB channels.The purpose. Development of mathematical models and a systematic approach to improving methods and means of protecting confidential information from leaks through the SERaB channels from the BHaS on the OoI.Results. The article substantiates the need for a systematic approach to improving the methods and means of protecting confidential information from leakage through the SERaB channels from the BHaS on the OoI. The authors determined the ways of ensuring the adequacy of the methodological apparatus for the study of these technologies in order to justify measures to prevent leakage. They formulate requirements for techniques used to evaluate the characteristics of measures to prevent information leakage through the SERaB channels. There are describe the procedure of forming the mathematical models set structure for evaluating such characteristics. Also in the article are present the analytical models of the time characteristics of threats to intercept informative SERaB signals on the OoI and measures to prevent information leakage. Finally, the authors are justify the probabilistic format of the indicator of the effectiveness of such measures.Practical relevance. The developed mathematical models can be an effective tool for evaluating the characteristics of measures to prevent information leakage through the SERaB channels.

Synthesis of a measuring composite signal for assessing the security of speech signals during discrete-quantized transformation

The purpose of the work is to systematically analyze and generalize a high-precision measuring signal for assessing the security in leakage channels in high-level noise by discrete-quantized representation of speech signals using the principles of amplitude-pulse modulation. It has been established that time sampling and level quantization of high-speed high-quality speech signals for digitalization are the main sources of information leakage. It is shown that to determine the degree of information security for high-quality high-speed transmission in broadband information transmission channels, it is necessary to use a complex measuring (test) composite signal. Requirements for the measuring signal are determined by the features of the discretequantized representation of speech signals. It is proposed to use a periodic pulse sequence of a triangular shape as a measuring signal. The triangular measurement signal has an advantage over the harmonic signal in the quantization noise extraction process, since allows you to achieve higher accuracy when processing it. To assess the security of the channel due to pulse-amplitude modulation, a harmonic signal is used, formed from a periodic pulse sequence of a triangular shape by the Fourier transform method. The use of the proposed measuring composite signal makes it possible to establish its numerical dependence with the numerical value of the signal taken as normalized and compare it to make a decision about the security of the speech signal. The materials presented in the article are original and can be used to assess the security of the channels of leakage of speech signals converted into digital form. In addition, the results obtained make it possible to carry out further studies of the security of speech signals during their reverse conversion from digital form to the original signal.

Enhancing Side Channel Attack-Resistance of the STTL Combining Multi-Vt Transistors with Capacitance and Current Paths Counterbalancing

Differential power analysis (DPA) exploits the difference between the instantaneous power of the circuit arches transitions to stole the state as information aiming to unveil the cryptographic key. Secure triple track logic (STTL) is a circuit-level countermeasure to DPA attacks based on dual-rail precharge logic (DPL). STTL is robust to attacks due to the delay in an insensitive feature that mitigates the logic glitches generated by the different path delays that lead to the logic gate inputs until they stabilize. The main STTL drawback, however, is the asymmetry of the transistor topology. Asymmetry causes unbalanced internal capacitances and different internal paths for the current flow, and DPA exploits it as a source of information leakage. Our work proposes three circuit topologies, combining multi-Vt transistors with a circuit counterbalancing strategy, aiming to improve the STTL DPA attack-resistance. Data encryption standard substitution-box circuit, designed in a TSMC 40 nm CMOS process, is our application case study to evaluate the DPA attack-resistance. Results gathered at the application-level show that our proposals outperform DPA attack-resistance of the prior work.

Leakier Wires

In complex FPGA designs, implementations of algorithms and protocols from third-party sources are common. However, the monolithic nature of FPGAs means that all sub-circuits share common on-chip infrastructure, such as routing resources. This presents an attack vector for all FPGAs that contain designs from multiple vendors, especially for FPGAs used in multi-tenant cloud environments, or integrated into multi-core processors. In this article, we show that “long” routing wires present a new source of information leakage on FPGAs, by influencing the delay of adjacent long wires. We show that the effect is measurable for both static and dynamic signals and that it can be detected using small on-board circuits. We characterize the channel in detail and show that it is measurable even when multiple competing circuits (including multiple long-wire transmitters) are present and can be replicated on different generations and families of Xilinx devices (Virtex 5, Virtex 6, Artix 7, and Spartan 7). We exploit the leakage to create a covert channel with 6kbps of bandwidth and 99.9% accuracy, and a side channel, which can recover signals kept constant for only 1.3sμs, with an accuracy of more than 98.4%. Finally, we propose countermeasures to reduce the impact of this leakage. 1

Are Crossbar Memories Secure? New Security Vulnerabilities in Crossbar Memories

Memristors are emerging Non-Volatile Memories (NVMs) that are promising for building future memory systems. Unlike DRAM, memristors are non-volatile, i.e., they can retain data after power loss. In contrast to DRAM where each cell is associated with a pass transistor, memristor cells can be implemented without such transistor, and hence enable high density ReRAM systems. Moreover, memristors leverage a unique crossbar architecture to improve the density of memory modules. Memristors have been considered to build future data centers with both energy-efficiency and high memory capacity goals. Surprisingly, we observe that using memristors in multi-tenant environments, e.g., cloud systems, entails new security vulnerabilities. In particular, the crossbar contents can severely affect the write latency of any data cells within the same crossbar. With various memory interleaving options (to optimize performance), a single crossbar might be shared among several applications/users from different security domains. Therefore, such content-dependent latency can open new source of information leakage. In this article, we describe the information leakage problem in memristor crossbar arrays (MCAs), discuss how they can be potentially exploited from application level. Our work highlights the need for future research to mitigate (and potentially eliminate) information leakage in crossbar memories in future computing systems.

Fault Attacks on Secure Embedded Software: Threats, Design, and Evaluation

Embedded software is developed under the assumption that hardware execution is always correct. Fault attacks break and exploit that assumption. Through the careful introduction of targeted faults, an adversary modifies the control-flow or data-flow integrity of software. The modified program execution is then analyzed and used as a source of information leakage, or as a mechanism for privilege escalation. Due to the increasing complexity of modern embedded systems, and due to the difficulty of guaranteeing correct hardware execution even under a weak adversary, fault attacks are a growing threat. For example, the assumption that an adversary has to be close to the physical execution of software, in order to inject an exploitable fault into hardware, has repeatedly been shown to be incorrect. This article is a review on hardware-based fault attacks on software, with emphasis on the context of embedded systems. We present a detailed discussion of the anatomy of a fault attack, and we make a review of fault attack evaluation techniques. The paper emphasizes the perspective from the attacker, rather than the perspective of countermeasure development. However, we emphasize that improvements to countermeasures often build on insight into the attacks.

Secure Codesign: Achieving Optimality Without Revealing

Information leakage can lead to loss of intellectual property and competitive edge. One of the primary sources of information leakage in collaborative design is sharing confidential information with collaborators, who may be also collaborating with competitors. Hiding information from collaborators is challenging in codesign because it can lead to inferior and suboptimal solutions. Therefore, there is a need for techniques that enable designers to protect confidential information from their collaborators while achieving solutions that are as good as those obtained when full information is shared. To address this need, we propose a secure codesign (SCD) framework that enables designers to achieve optimal solutions without sharing confidential information. It is built on two principles: adding/multiplying a parameter with a large random number hides the value of the parameter, and adding/multiplying a large number is orders of magnitude faster than using existing cryptographic techniques. Building on the protocols for basic arithmetic computations, developed in our earlier work, we establish protocols for higher order computations involved in design problems. The framework is demonstrated using three codesign scenarios: requirements-driven codesign, objective-driven codesign, and Nash noncooperation. We show that the proposed SCD framework enables designers to achieve optimal solutions in all three scenarios. The proposed framework is orders of magnitude faster than competing (but impractical for engineering design) cryptographic methods such as homomorphic encryption, without compromising on precision in computations. Hence, the proposed SCD framework is a practical approach for maintaining confidentiality of information during codesign.

Trace Buffer Attack on the AES Cipher

Since the standardization of AES/Rijndael symmetric-key cipher by NIST in 2001, it gained widespread acceptance in various protocols and withstood intense scrutiny from the theoretical cryptanalysts. From the physical implementation point of view, however, AES remained vulnerable. Practical attacks on AES via fault injection, differential power analysis, scan-chain and cache-access timing have been demonstrated so far. In this paper, we propose a novel and effective attack, termed Trace Buffer Attack. Trace buffers are extensively used for post-silicon debug of integrated circuits. We identify the trace buffer as a source of information leakage. We first report the detailed process of trace buffer attack assuming that the register-transfer level (RTL) implementation is available. We further analyze the AES encryption algorithm and Rijndael’s key expansion algorithm, and illustrate that trace buffer attack is feasible without implementation (RTL) knowledge. Our experimental results show that trace buffer attack is capable of partially recovering the secret keys of different AES implementations.

Insider Trading in Supervised Industries

AbstractWe investigate the impact of government agency oversight, such as by the Federal Reserve, on insider trading at the firm level. Regulatory supervision potentially limits trading based on material, nonpublic information, as it provides another layer of corporate governance to mitigate outflows of private information. Yet regulators themselves may serve as a source of information leakage, thereby facilitating insider-trading activity. We find, first, that in comparison to nonsupervised firms, supervised firms exhibit substantially greater trading based on inside information prior to earnings announcements. Second, in the first few days after firms provide private information to regulators or when regulators possess private information inaccessible to corporate insiders, these firms exhibit greater symptoms of insider trading. Finally, within a given supervised industry, insider-trading symptoms appear more pronounced when regulators exhibit greater leniency or operate in states with more political c...

Secure checkpointing

Fault-tolerant computer systems are increasingly being used in such applications as e-commerce, banking, and stock trading, where privacy and integrity of data are as important as the uninterrupted operation of the service provided. While much attention has been paid to the protection of data explicitly communicated over the Internet, there are also other sources of information leakage that must be addressed. This paper addresses one such source of information leakage caused by checkpointing, which is a common method used to provide continued operation in the presence of faults.Checkpointing requires the communication of memory state information, which may contain sensitive data, over the network to a reliable backing store. Although the method of encrypting all of this memory state information can protect the data, such a simplistic method is an overkill that can result in a significant slowdown of the target application. A much more efficient method is to use incremental checkpointing (IC), in which only the modified memory data is saved in stable storage. This paper examines ways to combine the operations required to perform IC with those required to encrypt this memory state data. Our analysis show that the proposed secure checkpointing schemes increase the overhead by 1.57 when compred to conventional checkpointing schemes, which shows the proposed schemes are feasible.