Electromagnetic Side Channel Information Leakage Created by Execution of Series of Instructions in a Computer Processor

Yilmaz, Baki Berkay; Prvulovic, Milos; Zajić, Alenka

doi:10.1109/tifs.2019.2929018

Cited by 24 publications

(8 citation statements)

References 32 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Even though it is more easy to identify the direct leakages of sensitive information, the indirect leakage of information from side channels cannot be spotted directly or easily. This can be taken in advantage in covert side channel attacks such as thermal side-channel attacks [9], electromagnetic side-channel analysis [10] targeting the cryptographic cores, processors, microprocessors [11] and cache registers [12].…”

Section: A) Confidentiality Integrity and Availabilitymentioning

confidence: 99%

Hardware Security and Trust: Trends, Challenges, and Design Tools

Siriwardana

2024

IRJIET

View full text Add to dashboard Cite

Hardware security in the cyber security domain had become a more of a controversial topic over the past decade due to the introduction of new design technologies in semiconductors and expansion of global supplier chains. In proportion to the technological advancement of hardware production, the success rate of the existing hardware attacks had also evolved over the time with a significantly high rate of emergence of new attacking techniques and methods. Computing hardware is becoming a more and more attractive attack surface due to several reasons. The technology of analyzing the hardware components is becoming more and more affordable and accessible to the general public than before. Also due to the influx of IoT devices in the market, trend of simplifying the design structure to decrease the power consumption and maximizing the processing speed has become the theme of modern hardware implementations rather than the security of the devices. When considering the market demand and user requirements, it is more obvious for the computer manufacturers to give priority to user requirements rather than stressing more on the security aspects of their designs and devices. But there could be some catastrophic outcomes if the security aspects of these hardware tends to fail in a critical infrastructure, because these semiconductors are used in devices ranging from simple IoT devices to more complex systems like SCADA systems. Therefore, it is always a better approach to find a balance ground between the user requirement as well as the security of the hardware, without compromising either of both in the design and development. In this article, it presents an overall insight to trends in Hardware Security domain, specifically related to modern computer hardware design and manufacturing processes, distribution, usage, their disposal and recycling. These various stages are analyzed under Three main objectives of exposing the threats to computer hardware, suggesting countermeasures to minimize or eliminate those threats and discussing about the utilization of various design tools that can assist in the way to securing these computer hardware systems in their day-to-day applications.

show abstract

Section: A) Confidentiality Integrity and Availabilitymentioning

confidence: 99%

Hardware Security and Trust: Trends, Challenges, and Design Tools

Siriwardana

2024

IRJIET

View full text Add to dashboard Cite

show abstract

“…In 2001, when Gandolfi et al [9] employed tiny EM probes to retrieve key material from three different types of microcontrollers completely, the effectiveness of EM side-channel attacks against secure systems was proven. More recently, FPGAs [98,125,126,145] and PCs [101,185] have been the targets of EM side-channel attacks that recovered cryptographic keys. The operator capability and information flow management are closely related to the dynamic power consumption of an FPGA implementation.…”

Section: B Fpga Chip Ic Microcontroller and Microprocessormentioning

confidence: 99%

Systematic Literature Review of EM-SCA Attacks on Encryption

Zunaidi,

Sayakkara,

Scanlon

2024

Preprint

View full text Add to dashboard Cite

Cryptography has become an essential tool in information security, preserving data confidentiality, integrity, and availability. However, despite rigorous analysis, cryptographic algorithms may still be susceptible to attack when used on real-world devices. Side-channel attacks (SCAs) are physical attacks that target cryptographic equipment through quantifiable phenomena such as power consumption, operational times, and EM radiation. These attacks are considered to be a significant threat to cryptography since they compromise the integrity of the algorithm by obtaining the internal cryptographic key of a device by seeing its physical implementation. The literature on SCAs has focused on real-world devices, yet with the growing popularity of sophisticated devices like smartphones, fresh approaches to SCAs are necessary. One such approach is electromagnetic side-channel analysis (EM-SCA), which gathers information by listening to electromagnetic (EM) radiation. EM-SCA has been demonstrated to recover sensitive data like encryption keys and has the potential to identify malicious software, retrieve data, and identify program activity. This study aims to evaluate how well EM-SCA compromises encryption under various application scenarios, as well as examine the role of EM-SCA in digital forensics and law enforcement. Regarding this, addressing the susceptibility of encryption algorithms to EM-SCA approaches can provide digital forensic investigators with the tools they desire to overcome the challenges posed by strong encryption, allowing them to continue playing a crucial role in law enforcement and the justice system. Furthermore, this paper seeks to define the current state of EM-SCA in terms of attacking encryption, the encryption algorithms and encrypted devices that are most vulnerable and resistant to EM-SCA, and the most promising EM-SCA on encryption approaches. This study will provide a comprehensive analysis of EM-SCA in the context of law enforcement and digital forensics and point towards potential directions for further research.

show abstract

“…There are several types of side channel attacks proposed such as cache side channel attack [33], timing side channel attack [23], power side channel attack [51], electromagnetic side channel attack [55], acoustic side channel attack [12], branch prediction side channel attack [13], et al The cache side channel attack is the most investigated attack method, which is implemented based on the fact that the execution time for a data load operation that misses the cache is obviously higher than that when hits the cache. Prime+Probe [46], Evict+Time [38,50], Flush+Flush [19], and Flush+Reload [54] are the four famous cache side channel attacks.…”

Section: Side Channel Attackmentioning

confidence: 99%

PMUSpill: The Counters in Performance Monitor Unit that Leak SGX-Protected Secrets

Qiu¹,

Lyu²,

Wang³

et al. 2022

Preprint

View full text Add to dashboard Cite

Performance Monitor Unit (PMU) is a significant hardware module on the current processors, which counts the events launched by processor into a set of PMU counters. Ideally, the events triggered by instructions that are executed but the results are not successfully committed (transient execution) should not be recorded. However, in this study, we discover that some PMU events triggered by the transient execution instructions will actually be recorded by PMU. Based on this, we propose the PMUSpill attack, which enables attackers to maliciously leak the secret data that are loaded during transient executions. The biggest challenge is how to encode the secret data into PMU events. We construct an instruction gadget to solve this challenge, whose execution path that can be identified by PMU counters represents what values the secret data are. We successfully implement the PMUSpill attack to leak the secret data stored in Intel Software Guard Extensions (SGX) (a Trusted Execution Environment (TEE) in the Intel's processors) through real experiments. Besides, we locate the vulnerable PMU counters and their trigger instructions by iterating all the valid PMU counters and instructions. The experiment results demonstrate that there are up to 20 PMU counters available to implement the PMUSpill attack. We also provide some possible hardware and software-based countermeasures for addressing the PMUSpill attack, which can be utilized to enhance the security of processors in future.

show abstract

Electromagnetic Side Channel Information Leakage Created by Execution of Series of Instructions in a Computer Processor

Cited by 24 publications

References 32 publications

Hardware Security and Trust: Trends, Challenges, and Design Tools

Hardware Security and Trust: Trends, Challenges, and Design Tools

Systematic Literature Review of EM-SCA Attacks on Encryption

PMUSpill: The Counters in Performance Monitor Unit that Leak SGX-Protected Secrets

Contact Info

Product

Resources

About