More Like this

1. Towards Cloud-based Infrastructure for Post-Quantum Cryptography Side-channel Attack Analysis

   Teague, Tristen; Mahzabin, Mayeesha; Nelson, Alexander; Andrews, David; Huang, Miaoqing (September 2023, 2023 IEEE Design Methodologies Conference)

   Post-quantum cryptography (PQC) refers to cryptographic algorithms that are thought to be secure against a cryptanalytic attack by a quantum computer. Before PQC algorithms can be widely deployed to replace the current standards such as the RSA algorithm, they need to be rigorously evaluated theoretically and practically. In this work, we present a cloud-based infrastructure being developed for performing side-channel analysis on PQC algorithms for the research community. Multiple types of side-channel attacks, such as timing attacks, power attacks, and electromagnetic attacks can be applied on different types of devices, such as FPGA devices and microcontrollers. An automated tool flow is being developed that can run executables on the target devices, collect traces (e.g., power consumption waveforms and electromagnetic radiation signals), perform leakage assessment (using Test Vector Leakage Assessment), and generate analysis reports. Remote users access the infrastructure through a web portal by uploading the hardware or software implementations of cryptographic algorithms. Side-channel attack and leakage analysis are performed on the given implementation. Finally, the user is informed for downloading the analysis report from the portal. 

   more » « less
2. LeakyOhm: Secret Bits Extraction using Impedance Analysis

   https://doi.org/10.1145/3576915.3623092  

   Khalaj Monfared, Saleh; Mosavirik, Tahoura; Tajik, Shahin (November 2023, ACM)

   The threats of physical side-channel attacks and their countermeasures have been widely researched. Most physical side-channel attacks rely on the unavoidable influence of computation or storage on current consumption or voltage drop on a chip. Such data-dependent influence can be exploited by, for instance, power or electromagnetic analysis. In this work, we introduce a novel non-invasive physical side-channel attack, which exploits the data-dependent changes in the impedance of the chip. Our attack relies on the fact that the temporarily stored contents in registers alter the physical characteristics of the circuit, which results in changes in the die's impedance. To sense such impedance variations, we deploy a well-known RF/microwave method called scattering parameter analysis, in which we inject sine wave signals with high frequencies into the system's power distribution network (PDN) and measure the echo of the signals. We demonstrate that according to the content bits and physical location of a register, the reflected signal is modulated differently at various frequency points enabling the simultaneous and independent probing of individual registers. Such side-channel leakage challenges the t-probing security model assumption used in masking, which is a prominent side-channel countermeasure. To validate our claims, we mount non-profiled and profiled impedance analysis attacks on hardware implementations of unprotected and high-order masked AES. We show that in the case of the profiled attack, only a single trace is required to recover the secret key. Finally, we discuss how a specific class of hiding countermeasures might be effective against impedance leakage. 

   more » « less
3. Key Update Countermeasure for Correlation-Based Side-Channel Attacks

   Yutian Gui, Suyash Mohan (April 2020, Journal of hardware and systems security)

   Side-channel analysis is a non-invasive form of attack that reveals the secret key of the cryptographic circuit by analyzing the leaked physical information. The traditional brute-force and cryptanalysis attacks target the weakness in the encryption algorithm, whereas side-channel attacks use statistical models such as differential analysis and correlation analysis on the leaked information gained from the cryptographic device during the run-time. As a non-invasive and passive attack, the side-channel attack brings a lot of difficulties for detection and defense. In this work, we propose a key update scheme as a countermeasure for power and electromagnetic analysis-based attacks on the cryptographic device. The proposed countermeasure utilizes a secure coprocessor to provide secure key generation and storage in a trusted environment. The experimental results show that the proposed key update scheme can mitigate side-channel attacks significantly. 

   more » « less
4. RefreshChannels: Exploiting Dynamic Refresh Rate Switching for Mobile Device Attacks

   https://doi.org/10.1145/3643832.3661864  

   Dong, Gaofeng; Wu, Jason; De_Gortari_Briseno, Julian; Singh, Akash Deep; Feng, Justin; Sarker, Ankur; Sehatbakhsh, Nader; Srivastava, Mani (June 2024, ACM)

   Mobile devices with dynamic refresh rate (DRR) switching displays have recently become increasingly common. For power optimization, these devices switch to lower refresh rates when idling, and switch to higher refresh rates when the content displayed requires smoother transitions. However, the security and privacy vulnerabilities of DRR switching have not been investigated properly. In this paper, we propose a novel attack vector called RefreshChannels that exploits DRR switching capabilities for mobile device attacks. Specifically, we first create a covert channel between two colluding apps that are able to stealthily share users' private information by modulating the data with the refresh rates, bypassing the OS sandboxing and isolation measures. Second, we further extend its applicability by creating a covert channel between a malicious app and either a phishing webpage or a malicious advertisement on a benign webpage. Our extensive evaluations on five popular mobile devices from four different vendors demonstrate the effectiveness and widespread impacts of these attacks. Finally, we investigate several countermeasures, such as restricting access to refresh rates, and find they are inadequate for thwarting RefreshChannels due to DDR's unique characteristics 

   more » « less
5. AI Assisted Electromagnetic Based Signature Construction in Malware Blacklisting

   Chen, Kejun; Chen, Zhaowen; Liu, Yuntao; Guo, Xiaolong; Feng, Xianglong (May 2026, IEEE)

   We propose a malware-centric blacklisting framework for side-channel security monitoring that identifies the type of malware present on embedded and IoT devices using electromagnetic (EM) signatures. In contrast to traditional reference model-based monitoring that primarily learns benign behavior and identifies deviations, our approach employs an Inverse One-Class Classification strategy grounded in the Complexity Hypothesis. By utilizing a 1D CNN-Autoencoder with a constrained bottleneck, we model the reconstruction residual as a Signal Complexity Indicator. This allows the framework to distinguish between high-entropy attack signals and low-dimensional benign executions without exhaustive benign profiling. At run time, the monitor analyzes short side-channel windows and outputs either a matched malware type or a principled no-match decision. We evaluate the proposed framework on the Arty-A7 100t FPGA platform using the NIST SARD Juliet Test Suite. Experimental results demonstrate that SC2V achieves an attack detection accuracy of 94.34% and robust malware-type identification, providing actionable, type-aware alerts for incident response. 

   more » « less