Embedded systems are prone to leak information via side-channels associated with their physical internal activity, such as power consumption, timing, and faults. Leaked information can be analyzed to extract sensitive data and devices should be assessed for such vulnerabilities. Side-channel power-supply leakage from embedded devices can also provide information regarding instruction-level activity for control code executed on these devices. Methods proposed to disassemble instruction-level activity via side-channel leakage have not addressed issues related to pipelined multi-clock-cycle architectures, nor have proven robustness or reliability. The problem of detecting malicious code modifications while not obstructing the sequence of instructions being executed needs to be addressed. In this article, instruction sequences being executed on a general-purpose pipelined computing platform are identified and instructions that make up these sequences are classified based on hardware utilization. Individual instruction classification results using a fine-grained classifier is also presented. A dynamic programming algorithm was applied to detect the boundaries of instructions in a sequence with a 100 percent accuracy. A unique aspect of this technique is the use of multiple power supply pin measurements to increase precision and accuracy. To demonstrate the robustness of this technique, power leakage data from ten target FPGAs programmed with a prototype of the pipelined architecture was analyzed and classification accuracies averaging 99 percent were achieved with instructions labeled based on hardware utilization. Individual instruction classification accuracies above 90 percent were achieved using a fine-grained classifier. Classification accuracies were also verified when a target FPGA was subjected to different controlled temperatures. The classification accuracies on discrete (ASIC) pipelined-architecture microcontrollers was 97 percent.

Side-channel analysis techniques have been demonstrated for secret information extraction, vulnerability assessment and intrusion analysis. However, these techniques have not been applied to identify instructions running on a general purpose pipelined computing platform. In this work we identify instruction execution sequences on these platforms using side-channel power measurements. The technique uses a Principal Component Analysis (PCA) based model to generate multiple power-supply templates and a novel post-processing dynamic programming algorithm for optimal template matching. One unique aspect of this technique is that we take measurements on multiple power supply pins on the device, to increase the precision and accuracy. We apply our dynamic programming algorithm, to detect the sequence of execution clock cycles, on templates for single instructions that provides accuracy in the range of 69.2% to 87.5% for ten thousand observations, from individual power supply pins. We further augment this technique to generate multiple dictionaries for various length instructions and use data from multiple power supply pins to increases the accuracy in the range of 87% to 100%. Further, classification rates for instruction templates based on operand addressing mode and specific hardware used, range from 87% to 100% using as few as 10 principal components. Using our methodology, we can determine malicious insertions in a pre-determined code sequence with a 100% accuracy, as demonstrated in the results.