status: Published

With growing concerns over physical security against power and electromagnetic side-channel attacks (SCA), this work provides a comprehensive analysis of different existing isolation countermeasures, especially the analysis of security-focused shunt low-dropout regulators (LDOs). Using both small-signal and large-signal analysis, we demonstrate that shunt LDOs offer superior security using the metric current-domain signature attenuation (CDSA) and load supply isolation (LSI) performance while mitigating mid-frequency power-supply ripple-rejection (PSR) peaking. Various existing shunt LDO architectures are evaluated, highlighting trade-offs between DC rejection and high-frequency CDSA response. Alternative isolation techniques such as galvanic isolation, digital LDOs, and integrated voltage regulators (IVRs) are also examined.

Gait parameters have been established as a health biomarker for physical and cognitive health for older adults. Extracting these parameters however requires specialist equipment such as on-body sensors or video-based systems. Identifying low-cost techniques to capture gait parameters can open the opportunity for in-home monitoring of gait related biomarkers. In this study, we demonstrate that gait can be analysed in in-door at-home settings using only the sound of footsteps. To establish a comparative baseline, we use inertial measurement units (IMUs) and video footages as reference systems alongside our proposed acoustics-based approach. Gait parameters, specifically cadence, step time, and stride time, were extracted from audio, video, and IMU data streams recorded from 10 community-dwelling older adults. Bland Altman Analysis was performed to assess the agreement between the parameter values from the three different systems. We found that the gait parameters derived from our acoustics-only system exhibit relative standard errors of 0.71% and 0.58% against IMU and video-based systems, respectively.

This work presents a power side-channel analysis (SCA) of a lightweight cryptography (LWC) algorithm, XOODYAK, implemented on an FPGA. First, we perform generic leakage detection tests for two phases of authenticated encryption with associated data (AEAD) mode, namely INITIALIZE, and ABSORB. Second, we develop novel hypothetical attack models for correlation power analysis (CPA) and demonstrate a success rate (SR) of 92%/82% and minimum-traces-to-disclosure (MTD)=13K/38K on the INITIALIZE/ABSORB phases, respectively. Third, we evaluate ABSORB against Profiled SCA using convolutional neural network (CNN), and achieve SR=96%/64% and MTD=2K/16K on the test set for the same/different keys used for training, respectively. Finally, we suggest low-overhead countermeasures to protect against these SCA attacks.

While cryptographic implementations provide computational security in circuits and systems, hardware attack techniques, e.g., electromagnetic (EM) side-channel analysis (SCA) attack can still break through. The commonplace countermeasures for EM SCA attack require significant overheads in terms of power consumption. This article explores an on-chip capacitive sensing technique for the purpose of detection of an approaching EM probe even before an attack is performed, thereby alleviating the overheads incurred by any countermeasure against such attacks. Different type of capacitive structures are considered in regards to sensitivity and area. The proposed method of coplanar capacitive asymmetry sensing (CEASE) consists of a grid of four metal plates of the same size and dimensions determined through design space exploration. A comparison between the capacitive and inductive sensing technique is also performed in terms of detection range through theoretical arguments and EM simulation. A$>$17% change in capacitance is shown at a distance of 1 mm, implying a$>10\times $improvement in the detection range over inductive sensing methods. Furthermore, at 0.1-mm distance, a$>$45% change in capacitance is observed, leading to a$>3\times $and$>11\times $sensitivity improvement over capacitive parallel plate sensing and inductive sensing, respectively.

Securing ICs are becoming increasingly challenging with rapid improvements in electromagnetic (EM) side-channel analysis (SCA) and fault injection (FI) attacks. In this work, we develop a pro-active approach to detect and counter these attacks by embedding a single on-chip integrated loop around a crypto core (AES-256), designed and fabricated using TSMC 65nm process. The measured results demonstrate that the proposed system 1) provides EM-Self-awareness by acting as an on-chip H-field sensor, detecting voltage/clock glitching fault-attacks; 2) senses an approaching EM probe to detect any incoming threat; and 3) can be used to induce EM noise to increase resilience against EM attacks. This work combines EM analysis, ML based secured system and shows the efficacy by measurements from custom-built 65nm CMOS IC.

This work presents a Cross-device Deep-Learning based Electromagnetic (EM-X-DL) side-channel analysis (SCA) on AES-128, in the presence of a significantly lower signal-to-noise ratio (SNR) compared to previous works. Using a novel algorithm to intelligently select multiple training devices and proper choice of hyperparameters, the proposed 256-class deep neural network (DNN) can be trained efficiently utilizing pre-processing techniques like PCA, LDA, and FFT on measurements from the target encryption engine running on an 8-bit Atmel microcontroller. In this way, EM-X-DL achieves >90% single-trace attack accuracy. Finally, an efficient end-to-end SCA leakage detection and attack framework using EM-X-DL demonstrates high confidence of an attacker with <20 averaged EM traces.

This work presents a white-box modeling of the electromagnetic (EM) leakage from an integrated circuit (IC) to develop EM side-channel analysis (SCA)-aware design techniques. A new digital library cell layout design technique is proposed to minimize the EM leakage and is evaluated using a high-frequency structure simulator (HFSS)-based framework. Backed by our physics-based understanding of EM radiation, the proposed double-row power grid-based digital cell layout design shows$>5\times $reduction in the EM SCA leakage compared to the traditional digital logic gate layout design. Furthermore, exploiting the magneto-quasistatic (MQS) regime of operation of the EM leakage from the CMOS circuits, the HFSS-based framework is utilized to develop a pre-silicon (Si) EM SCA evaluation technique to assess the vulnerability of cryptographic implementations against such attacks during the design phase itself.

Electromagnetic (EM) side-channel analysis (SCA) attack, which breaks cryptographic implementations, has become a major concern in the design of circuits and systems. This paper focuses on EM SCA and proposes the detection of an approaching EM probe even before an attack is performed. The proposed method of co-planar capacitive asymmetry sensing consists of a grid of four metal plates of the same size and dimension. As an EM probe approaches the sensing metal plates, the symmetry of the sensing metal plate system breaks, and the capacitance between each pair diverge from their baseline capacitances. Using Ansys Maxwell Finite Element Method (FEM) simulations, we demonstrate that the co-planar capacitive asymmetry sensing has an enhanced detection range compared to other sensing methods. At a distance of 1 mm between the sensing metal plates and the approaching EM probe, it shows >17 % change in capacitance, leading to a > 10 × improvement in detection range over the existing inductive sensing methods. At a distance of 0.1 mm, a > 45% change in capacitance is observed, leading to a > 3 × and > 11 × sensitivity improvement over capacitive parallel sensing and inductive sensing respectively. Finally, we show that the co-planar capacitive asymmetry sensing is sensitive to both E-field and H-field probes, unlike inductive sensing which cannot detect an E-field probe.

An adversary can exploit side-channel information such as power consumption, electromagnetic (EM) emanations, acoustic vibrations or the timing of encryption operations to derive the secret key from an electronic device. Signature aTtenuation Embedded CRYPTO with Low-Level metAl Routing (STELLAR) is a technique to mitigate power and EM-based attacks, however, it incurs 50% power overhead. This work presents iSTELLAR, which reduces the power overhead by operating STELLAR intermittently utilizing an intelligent scheduling algorithm. The proposed scheduling algorithm for iSTELLAR determines the optimal locations during the crypto operation to turn STELLAR ON, and thereby reduces the power overhead by$> 30\%$compared to the normal STELLAR operation, while eliminating the information leakage.

Electromagnetic (EM) side-channel analysis (SCA) attack, which breaks cryptographic implementations, has become a major concern in the design of circuits and systems. This paper presents the design and analysis of the EM side-channel attack detection system utilizing patterned-ground co-planar capacitive asymmetry sensing (PG-CAS) for approaching probe, targeting to improve sensitivity, detection range, and power consumption compared to LC oscillator utilizing inductive sensing. The PG-CAS consists of a grid of four metal plates of the same size at the top metal layer and a patterned ground plane at a lower metal. As an EM probe approaches, electric field lines between the plates and plate-ground get distorted, thereby breaking the symmetry of the inter-plate and the plate-ground capacitance system and this change in capacitance is sensed. The PG-CAS circuit consists of two LC oscillators, mixer, low pass filter (LPF), resistive feedback amplifier (RFA) and a digital logic. By down-converting sensing signal to low-frequency using mixer, LPF, RFA and digital logic, the detection range is significantly improved. At a distance of 1 mm between the sensing metal plates and the approaching EM probe, system-level simulation results using TSMC 65nm technology and Ansys Maxwell show a > 10% change in the output frequency from the baseline frequency, leading to a > 10× improvement in the detection range and a ~ 3× improvement in power consumption over existing inductive sensing methods.

Communication during touch provides a seamless and natural way of interaction between humans and ambient intelligence. Current techniques that couple wireless transmission with touch detection suffer from the problem of selectivity and security, i.e., they cannot ensure communication only through direct touch and not through close proximity. We present BodyWire-HCI , which utilizes the human body as a wire-like communication channel, to enable human–computer interaction, that for the first time, demonstrates selective and physically secure communication strictly during touch. The signal leakage out of the body is minimized by utilizing a novel, low frequency Electro-QuasiStatic Human Body Communication (EQS-HBC) technique that enables interaction strictly when there is a conductive communication path between the transmitter and receiver through the human body. Design techniques such as capacitive termination and voltage mode operation are used to minimize the human body channel loss to operate at low frequencies and enable EQS-HBC. The demonstrations highlight the impact of BodyWire-HCI in enabling new human–machine interaction modalities for variety of application scenarios such as secure authentication (e.g., opening a door and pairing a smart device) and information exchange (e.g., payment, image, medical data, and personal profile transfer) through touch (https://www.youtube.com/watch?v=Uwrig2XQIH8).

This article, for the first time, demonstrates Cross-device Deep Learning Side-Channel Attack (X-DeepSCA), achieving an accuracy of > 99.9%, even in presence of significantly higher inter-device variations compared to the inter-key variations. Augmenting traces captured from multiple devices for training and with proper choice of hyper-parameters, the proposed 256-class Deep Neural Network (DNN) learns accurately from the power side-channel leakage of an AES-128 target encryption engine, and an N-trace (N ≤ 10) X-DeepSCA attack breaks different target devices within seconds compared to a few minutes for a correlational power analysis (CPA) attack, thereby increasing the threat surface for embedded devices significantly. Even for low SNR scenarios, the proposed X-DeepSCA attack achieves ~ 10× lower minimum traces to disclosure (MTD) compared to a traditional CPA.

Traditional authentication in radio-frequency (RF) systems enable secure data communication within a network through techniques such as digital signatures and hash-based message authentication codes (HMAC), which suffer from key-recovery attacks. State-of-the-art Internet of Things networks such as Nest also use open authentication (OAuth 2.0) protocols that are vulnerable to cross-site-recovery forgery (CSRF), which shows that these techniques may not prevent an adversary from copying or modeling the secret IDs or encryption keys using invasive, side channel, learning or software attacks. Physical unclonable functions (PUFs), on the other hand, can exploit manufacturing process variations to uniquely identify silicon chips which makes a PUF-based system extremely robust and secure at low cost, as it is practically impossible to replicate the same silicon characteristics across dies. Taking inspiration from human communication, which utilizes inherent variations in the voice signatures to identify a certain speaker, we present RF-PUF: a deep neural network-based framework that allows real-time authentication of wireless nodes, using the effects of inherent process variation on RF properties of the wireless transmitters (Tx), detected through in-situ machine learning at the receiver (Rx) end. The proposed method utilizes the already-existing asymmetric RF communication framework and does not require any additional circuitry for PUF generation or feature extraction. The burden of device identification is completely shifted to the gateway Rx, similar to the operation of a human listener's brain. Simulation results involving the process variations in a standard 65-nm technology node, and features such as local oscillator offset and I-Q imbalance detected with a neural network having 50 neurons in the hidden layer indicate that the framework can distinguish up to 4800 Tx(s) with an accuracy of 99.9% [≈99% for 10000 Tx(s)] under varying channel conditions, and without the need for traditional preambles. The proposed scheme can be used as a stand-alone security feature, or as a part of traditional multifactor authentication.

Power side-channel analysis (SCA) has been of immense interest to most embedded designers to evaluate the physical security of the system. This work presents profiling-based cross-device power SCA attacks using deep-learning techniques on 8-bit AVR microcontroller devices running AES-128. First, we show the practical issues that arise in these profiling-based cross-device attacks due to significant device-to-device variations. Second, we show that utilizing principal component analysis (PCA)-based preprocessing and multidevice training, a multilayer perceptron (MLP)-based 256-class classifier can achieve an average accuracy of 99.43% in recovering the first keybyte from all the 30 devices in our data set, even in the presence of significant interdevice variations. Results show that the designed MLP with PCA-based preprocessing outperforms a convolutional neural network (CNN) with four-device training by ~20% in terms of the average test accuracy of cross-device attack for the aligned traces captured using the ChipWhisperer hardware. Finally, to extend the practicality of these cross-device attacks, another preprocessing step, namely, dynamic time warping (DTW) has been utilized to remove any misalignment among the traces, before performing PCA. DTW along with PCA followed by the 256-class MLP classifier provides ≥10.97% higher accuracy than the CNN-based approach for cross-device attack even in the presence of up to 50 time-sample misalignments between the traces.

Connected smart wearable devices are becoming increasingly popular with the advent of cheap, miniaturized, ultra-low-power computing and communication. Human Body Communication (HBC) is emerging as an alternative to Wireless Body Area Network (WBAN) for communication among these devices, as it provides higher energy-efficiency and security. One of the biggest bottleneck of HBC is the interference picked up due to the human body antenna effect, with Signal to Interference Ratio often worse than -20dB. An interference robust integrating dual data rate (DDR) receiver is introduced which can adapt itself to changing interference conditions and provide high interference rejection by Pulse Width Modulation of integration clock, thus dynamically changing its duty cycle. The theory, architecture of the receiver is developed along with the adaptation algorithm to train the receiver to find the optimum duty cycle of operation. System-level simulations show >20 dB of rejection even in presence of variable interference frequencies.

Continuous miniaturization and cost reduction of unit computing has led to the prolific growth of smart wearable devices. These devices, present on and around the human body, form a complex network known as the Human-Intranet. The Human-Intranet is typically connected through Wireless Body Area Network (WBAN). However, Human Body Communication (HBC) has recently emerged as an energy-efficient and secure alternative that uses the human body as the communication medium. Human-human, human-machine interaction creates dynamic HBC channels, which allow these Human-Intranets to interact with each other forming a Human-Internet. In this paper, we present the concept and demonstration of Secure Human-Internet using dynamic HBC. We highlight important applications of Human-Internet and discuss the architecture of a wearable Human-Internet device capable of communicating through inter-body dynamic HBC. A custom-built hardware prototype is used to demonstrate for the first time information exchange (e.g. business card) during handshaking. Dynamic signal transfer characteristics during inter-body communication through handshake between two individuals wearing such devices are measured and analyzed. The effects of data transmission rate, handshake posture on the HBC based inter-body communication is explored to demonstrate its effectiveness and limitations under varying realistic scenarios. The specific COTS based HBC implementation shows > 8× better energy efficiency compared to the Bluetooth implementation.

In wireless sensor networks, adaptive tuning of Medium Access Control (MAC) parameters is necessary in order to assure the QoS requirements. In this paper, we propose an adaptive MAC-frame payload tuning mechanism for wireless body area networks (WBANs) to maximize the probability of successful packet delivery or reliability of the associated sensor nodes based on real-time situation. The enabling algorithm, Adaptively Tuned MAC (AT-MAC), has been proposed to tune the MAC-frame payload of a WBAN sensor node, which is compliant with the IEEE 802.15.4 protocol. AT-MAC prioritizes sensor nodes based on the seriousness of the health parameters that are being measured by the respective sensor nodes. Further, we consider a Markov chain-based analytical approach that acknowledges the slotted CSMA/CA backoff mechanism with retry limits, as described in the IEEE 802.15.4 protocol. We derive expressions for reliability, power consumption, and throughput, which are the key metrics to evaluate the network performance of the proposed protocol, and analyze the impact of MAC parameters on them. Finally, results indicate that the low rate and low power IEEE 802.15.4 can be used effectively in case of WBANs if the payload is tuned properly through the proposed algorithm. The proposed AT-MAC algorithm yields around 70 percent increase in reliability of a critical node in a WBAN.