Open Access

We present a new method for protecting chips against counterfeits that makes the IC identification more accessible to the end user. Our method requires the original chip manufacturer to frequently publish identification sequences for each IC. These sequences are excerpts from the output of a stream cipher that is embedded in the protected chip and parameterized by a secret unique key. The key initialization is done by a trusted party after manufacturing. For IC verification, the end user measures the side channel leakage of the chip under test. The chip is assessed to be genuine if the end user finds a significant correlation between the observed side channel leakage and several previously published identification sequences.

We propose a new technique called Differential Cluster Analysis for side-channel key recovery attacks. This technique uses cluster analysis to detect internal collisions and it combines features from previously known collision attacks and Differential Power Analysis. It captures more general leakage features and can be applied to algorithmic collisions as well as implementation specific collisions. In addition, the concept is inherently multivariate. Various applications of the approach are possible: with and without power consumption model and single as well as multi-bit leakage can be exploited. Our findings are confirmed by practical results on two platforms: an AVR microcontroller with implemented DES algorithm and an AES hardware module. To our best knowledge, this is the first work demonstrating the feasibility of internal collision attacks on highly parallel hardware platforms. Furthermore, we present a new attack strategy for the targeted AES hardware module.

TinyECC 2.0 is an open source library for Elliptic Curve Cryptography (ECC) in wireless sensor networks. This paper analyzes the side channel susceptibility of TinyECC 2.0 on a LOTUS sensor node platform. In our work we measured the electromagnetic (EM) emanation during computation of the scalar multiplication using 56 different configurations of TinyECC 2.0. All of them were found to be vulnerable, but to a different degree. The different degrees of leakage include adversary success using (i) Simple EM Analysis (SEMA) with a single measurement, (ii) SEMA using averaging, and (iii) Multiple-Exponent Single-Data (MESD) with a single measurement of the secret scalar. It is extremely critical that in 30 TinyECC 2.0 configurations a single EM measurement of an ECC private key operation is sufficient to simply read out the secret scalar. MESD requires additional adversary capabilities and it affects all TinyECC 2.0 configurations, again with only a single measurement of the ECC private key operation. These findings give evidence that in security applications a configuration of TinyECC 2.0 should be chosen that withstands SEMA with a single measurement and, beyond that, an addition of appropriate randomizing countermeasures is necessary.

Given two embedded systems that perform the same task, how can we tell without looking at their source code whether or not they have been independently developed? This is a serious problem that might cause large monetary loss for embedded software companies that distribute their intellectual property (IP) without taking countermeasures against plagiarists. By committing IP violation, the plagiarist can save the cost and time that it took to develop the original software and bring a system with the same functionality but for a cheaper price to market.We address this problem by making use of side channels and faults — properties of physical systems that allow us to distinguish some of the performed instructions and computations. By passively observing the side channels, or even by actively creating them, we can detect plagiarized IP and prove or disprove its existence. In this work we present an overview of our research for IP protection in software.Related lab set-ups for teaching side channel and fault analysis in undergraduate and graduate studies at universities are described. This includes our regularly used Differential Power Analysis (DPA) Lab and Differential Fault Analysis (DFA) Lab as well as advanced labs that result from our research in side channel and fault channel watermarking.

Common template attacks are probabilistic relying on the multivariate Gaussian distribution regarding the noise of the device under attack. Though this is a realistic assumption, numerical problems are likely to occur in practice due to evaluation in higher dimensions. To avoid this, a feature selection is applied to identify points in time that contribute most information to an attack. An alternative to common template attacks is to apply machine learning in form of support vector machines (SVMs). Recent works brought out approaches that produce comparable results, respectively better in the presence of noise, but still not optimal in terms of efficiency and performance. In this work we show how to adapt the SVM template approach in order to considerably reduce the effort while carrying out the attack and how to better exploit the side-channel information under the assumption of an attack model with a strict order, e.g. Hamming weight model.

This paper presents a new method for protecting netlist-based Intellectual Property (IP) cores in FPGAs by actively using voltage-controlled side-channel receivers. The receivers are realized by modulating the supply voltage of the chip, while at the same time detecting these changes from within the chip using a ring oscillator. The levels of the supply voltage can be determined by constantly monitoring the frequency of the ring oscillator. To prove authorship of an IP core, the verifier authenticates himself to the core over the voltage side-channel and sends commands that limit the core's functionality. By monitoring the regular outputs of the overall system, it is possible to detect illegitimately used cores after repeatedly turning them on and off. The working principle of our method is demonstrated by a case study, in which we protect several IP cores and place them on a Spartan 3 FPGA, and show the steps necessary for successful proof of ownership verification.

We present an implementation for Differential Power Analysis (DPA) that is entirely based on Graphics Processing Units (GPUs). In this paper we make use of advanced techniques offered by the CUDA Framework in order to minimize the runtime. In security testing DPA still plays a major role for the smart card industry and these evaluations require, apart from educationally prepared measurement setups, the analysis of measurements with large amounts of traces and samples, and here time does matter. Most often DPA implementations are tailor-made and adapted to fit certain platforms and hence efficient reference implementations are sparsely seeded. In this work we show that the powerful architecture of graphics cards is well suited to facilitate a DPA implementation, based on the Pearson correlation coefficient, that could serve as a high performant reference, e.g., by analyzing one million traces of 20k samples in less than two minutes.

RFID is a technology for automated identification over a radio interface and drives many applications in ubiquitous and pervasive computing today. RFID systems are applied in security-sensitive areas such as ticketing, electronic passports, product anti-counterfeiting or entry systems. This chapter investigates generic and low-level aspects of RFID security and privacy. It gives the basic notions of security threats, objectives and mechanisms and introduces different categories of RFID systems. The chapter discusses security threats, attacks against RFID systems and possible countermeasures. The generic threats are eavesdropping, denial-of-service, manipulation, and generation of messages. It presents specific attacks such as relaying, cloning, and cryptanalytic attacks against widespread RFID systems. Furthermore, the chapter revisits attacks on the physical implementation of security mechanisms.

We present new methods for detecting plagiarized code segments using side-channel leakage of microcontrollers. Our approach uses the dependency of side-channel leakage on processed data and requires that the implementation under test accepts varying known input data. Detection tools are built upon a similarity matrix that contains the absolute correlation coefficient for each combination of time samples of the two possibly different implementations as result of side channel measurements. These methods are evaluated on smartcards with ATMega163 microcontroller using different test applications written in assembly language. We show that our methods are highly robust even against a skilled adversary who modifies the original assembly code in various ways. Our approach is non-intrusive, so that the application does not need to be additionally watermarked in order to be protected—the resulting pattern of data leakage of the microcontroller executing the code is considered as its own watermark.