Membership inference attacks (MIAs) are important measures to evaluate potential risks of privacy leakage from machine learning (ML) models. State-of-the-art MIA defenses have achieved favorable privacy-utility trade-offs using knowledge distillation on split training datasets. However, such defenses increase computational costs as a large number of the ML models must be trained on the split datasets. In this study, we proposed a new MIA defense, called SEDMA, based on self-distillation using model aggregation to mitigate the MIAs, inspired by the model parameter averaging as used in federated learning. The key idea of SEDMA is to split the training dataset into several parts and aggregate multiple ML models trained on each split for self-distillation. The intuitive explanation of SEDMA is that model aggregation prevents model over-fitting by smoothing information related to the training data among the multiple ML models and preserving the model utility, such as in federated learning. Through our experiments on major benchmark datasets (Purchase100, Texas100, and CIFAR100), we show that SEDMA outperforms state-of-the-art MIA defenses in terms of membership privacy (MIA accuracy), model accuracy, and computational costs. Specifically, SEDMA incurs at most approximately 3 - 5% model accuracy drop, while achieving the lowest MIA accuracy in state-of-the-art empirical MIA defenses. For computational costs, SEDMA takes significantly less processing time than a defense with the state-of-the-art privacy-utility trade-offs in previous defenses. SEDMA achieves both favorable privacy-utility trade-offs and low computational costs.

The use of physically unclonable functions (PUFs) as a new cryptographic technique is gaining attention. Challenge-response authentication and key generation (key storage) are well known as major applications using PUFs. When PUFs are applied to these applications, min-entropy estimation is essential. The min-entropy is a measure of the lower bound of the unpredictability of PUF responses. Many studies have estimated the min-entropy of PUFs, and several of these studies dealt with PUFs with independent and identically distributed (IID) PUF responses. Few studies have focused on non-IID PUFs. One reason is that some causes of entropy loss are complicatedly intertwined, and the entropy estimation of non-IID PUFs is hard. Thus, it is first necessary to break down the intertwined causes to estimate min-entropy. In this paper, we present typical causes of entropy loss during PUF implementation and propose a cause analysis method using the Inter-Hamming distance (HD), which is one of major performance metrics of PUFs. And the proposed method was applied to prototyped PUFs designed with a 180-nm CMOS process. We demonstrate that the causes of entropy loss on each PUF can be broken down according to the analysis results.

Various deep neural network (DNN) accelerators have been proposed for artificial intelligence (AI) inference on edge devices. On the other hand, hardware security issues of the DNN accelerator have not been discussed well. Trained DNN models are important intellectual property and a valuable target for adversaries. In particular, when a DNN model is implemented on an edge device, adversaries can physically access the device and try to reveal the implemented DNN model. Therefore, the DNN execution environment on an edge device requires countermeasures such as data encryption on off-chip memory against various reverse-engineering attacks. In this paper, we reveal DNN model parameters by utilizing correlation power analysis (CPA) against a systolic array circuit that is widely used in DNN accelerator hardware. Our experimental results show that the adversary can extract trained model parameters from a DNN accelerator even if the DNN model parameters are protected with data encryption. The results suggest that countermeasures against side-channel leaks are important for implementing a DNN accelerator on FPGA or ASIC.

In the field of image recognition, machine learning technologies, especially deep learning, have been rapidly advancing alongside with the advances of hardware such as GPUs. In image recognition, in general, large numbers of labeled sets containing image and correct value pairs to be identified are input to a neural network, and repeatedly learning the set enables the neural network to identify objects with high accuracy. A new side-channel attack method, deep learning side-channel attack (DLSCA), utilizes the high identifying ability of the neural network to try and unveil a secret key of the cryptographic module by being trained with power waveforms and learning the leak model. However, at this stage, attacks on software implementations have been mainly investigated. In contrast, there are few studies about hardware implementations especially such as ASIC circuits. In this paper, we investigate the use of DL-SCA against hardware implementations of AES and demonstrate that it is able to unveil the secret key by applying a new technique named "mixed model dataset based on round-round XORed value." We also compare the attack performance and characteristics of DL-SCA with conventional analysis methods such as correlation power analysis and conventional template attack.

This work presents a model-extraction attack on a DNN accelerator, which is implemented on FPGA. An adversary can get DNN model parameters by exploiting electromagnetic leakage from the accelerator during operation. Our experimental results show that the adversary can extract trained model parameters from a DNN accelerator even if the DNN model parameters are protected with data encryption. This suggests that countermeasures against side-channel leaks are important when implementing a DNN accelerator on FPGA or ASIC.

As a threat of security devices, side-channel attacks (SCAs) and invasive attacks have been identified in the last decade. The SCA reveals a secret key on a cryptographic circuit by measuring power consumption or electromagnetic radiation during the cryptographic operations. We have proposed the MDR-ROM scheme as the low-power and small-area counter-measure against SCAs. Meanwhile, secret data in a nonvolatile memory is analyzed by invasive attacks, and the cryptographic device is counterfeited and cloned by an adversary. We proposed to combine the MDR-ROM scheme with the Physical Unclonable Function (PUF) technique, which is expected as the counter-measure against the counterfeit, and the prototype chip was fabricated with a 180nm CMOS technology. In addition, the keyless entry demonstration system was produced in order to present the effectiveness of SCA resistance and PUF technique. Our experiments confirmed that this demonstration system achieved sufficient tamper resistance.

Side-channel attacks reveal the secret key of a cryptographic circuit by measuring power consumption or electromagnetic radiation during cryptographic operations. Side-channel information leaks that are exploited by power analysis (PA) and electromagnetic analysis (EMA) attacks are thought to be caused by consumption current. However, our research group recently found novel geometric leaks that only EMA attacks can target successfully. This paper studies the causes of memory-dependent EM geometric leaks. We find that the current flow from bit-lines to the ground through the activated ROM cell causes the geometric leaks. We propose a new ROM structure to reduce geometric leak, and use the new ROM to design an AES cryptographic circuit that is resistant to side-channel attacks. Our experiments confirm that the new ROM greatly reduces geometric leak and reveals no key data during PA or EMA attacks.

This paper introduces an hierarchical masked image filtering technology on security camera for privacy protection. Demonstration system is simulated to security-camera and its environment. This system can be masking or unmasking on human face, which is recognized automatically, in real time. After that, the notebook PC receives masked images via a LAN connection from the ultra-compact single board computer (Beagle-Board-xM) and executes unmasking operation depending on authorization. Thus, the proposed system can give visitors experience of privacy protection effect by comparing between two monitors.

In current countermeasure design trends against differential power analysis (DPA), security at gate level is required in addition to the security algorithm. Several dual-rail pre-charge logics (DPL) have been proposed to achieve this goal. Designs using ASIC can attain this goal owing to its backend design restrictions on placement and routing. However, implementing these designs on field programmable gate arrays (FPGA) without information leakage is still a problem because of the difficulty involved in the restrictions on placement and routing on FPGA. This article describes our novel masked dual-rail pre-charged memory approach, called “intra-masking dual-rail memory (IMDRM) on LUT”, and its implementation on FPGA for Side-Channel Attack-resistant (SCA-resistant) AES. In the proposed design, all unsafe nodes, such as unmasking and masking, and parts of dual-rail memory with unsafe buses (buses that are not masked) are packed into a single LUT. This makes them balanced and independent of the placement and routing tools. Inputs and outputs of all LUTs are masked, and so can be considered safe signals. Several LUTs can be combined to create a safe SBox. The design is independent of the cryptographic algorithm, and hence, it can be applied to available cryptographic standards such as DES or AES as well as future standards. It requires no special placement or route constraints in its implementation. A correlation power analysis (CPA) attack on 1,000,000 traces of AES implementation on FPGA showed that the secret information is well protected against first-order side-channel attacks. Even though the number of LUTs used for memory in this implementation is seven times greater than that of the conventional unprotected single-rail memory table-lookup AES and three times greater than the implementation based on a composite field, it requires a smaller number of LUTs than all other advanced SCA-resistant implementations such as the wave dynamic differential logic, masked dual-rail pre-charge logic, and threshold.

In current countermeasure design trends against Different Power Analysis (DPA), security at gate level is required in addition to the security algorithm. Several Dual-rail pre-charge logics (DPL) have been proposed to achieve this goal. Designs using ASIC can attain this goal owing to its backend design restrictions on placement and routing. However, implementing these designs on Field Programmable Gate Array (FPGA) without information leakage is still a problem because of the difficulty involved in the restrictions on placement and routing on FPGA. This paper describes our novel Hybrid Masking implementations using Intra-Masking Dual-rail Memory (IMDRM) approach for Side-channel-resistant AES. The hybrid masking scheme includes an additive mask and a multiplicative mask. The additive masking scheme utilizes a dual-rail memory, in which all unsafe nodes, such as unmasking and masking, the dual-rail memory and buses are packed into a single LUT. This makes them balanced and independent of the placement and routing tools. The multiplicative masking scheme is then applied over the additive masked values. It removes the joint-leakage, which is caused by the joint processing of the masks and the masked values inside the dual-rail memory. The design is independent of the cryptographic algorithm and persistent with SCA attacks even after 1,000,000 traces. It also occupied smaller hardware size than most other advanced SCA resistant implementations such as the Wave Dynamic Differential Logic, the Masked Dual-Rail Pre-charge Logic, and the Intra-Masking Dual-Rail Memory.

The LSI design methodology against Differential Power Analysis (DPA) is important to realize a tamper-resistant cryptographic circuit. In order to verify the DPA resistance before ASIC fabrication, the DPA verification using FPGA is commonly used. However, power traces of ASIC differ from that of FPGA, so the DPA verification on FPGA cannot guarantee the DPA resistance on ASIC. On the other hand, it takes extremely long time to collect the simulated power traces using post-layout netlists of ASIC. Hence, the DPA-resistance verification method using smaller number of power traces is demanded. In this paper, we propose Equivalent Byte Method (EBM) which synchronizes the operation on all Substitution Boxes (S-Boxes) at the attacking round by controlling the plaintexts and the keys. In EBM, the power-consumption profiles of S-Boxes are emphasized by each other, and then the DPA analysis for a correct key is easily distinguished with smaller number of traces. In order to demonstrate the effectiveness of the proposed EBM, AES circuits using DPA-resistant techniques of WDDL and MDPL are implemented on FPGA. As a result, EBM revealed DPA-leak with 1/1000 ~ 1/50 power traces required for the general statistical method.

In current countermeasure design trends against differential power analysis (DPA), security at gate level is required in addition to the security algorithm. Several dual-rail pre-charge logics (DPL) have been proposed to achieve this goal. Designs using ASIC can attain this goal owing to its backend design restrictions on placement and routing. However, implementing these designs on field programmable gate arrays (FPGA) without information leakage is still a problem because of the difficulty involved in the restrictions on placement and routing on FPGA.

Physical Unclonable Functions (PUFs) have been proposed to produce tamper-resistant device or create unique identifications of the secure systems. The conventional basic arbiter-PUF was fabricated with 0.18μm CMOS technology, and the uniqueness of generated multi-bit responses was evaluated. The uniqueness is inadequate than expected because some of multi-bit responses are never generated. In this study, we propose a novel arbiter-PUF utilizing a RG-DTM (Response Generation according to Delay Time Measurement) scheme. The uniqueness is evaluated by the standard deviation of the Hamming Distance distribution between generated 256-bit responses. The standard deviation on the proposed PUFs is greatly improved to 8.45 from 31 on the conventional PUFs.