Identification of Microcontroller Unit Instruction Execution Using Electromagnetic Leakage and Neural Network Classification

Yuan, Shih‐Yi

doi:10.1109/temc.2022.3159868

Cited by 4 publications

(45 citation statements)

References 48 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Some electronic attacks are based on the MCU's side effects. They are called side-channel attacks [1] [8]. The secret information of a victim program executed inside an MCU can be exposed by such attacks [8].…”

Section: Introductionmentioning

confidence: 99%

“…They are called side-channel attacks [1] [8]. The secret information of a victim program executed inside an MCU can be exposed by such attacks [8]. These side-effects may include system execution time, transient power consumption, or EM radiation of an MCU.…”

Section: Introductionmentioning

confidence: 99%

“…In [8], the author designed a platform to analyze the EM radiation side-channel information leakage (EM-leak) signals via a neural network (NN) model (FIGURE 1). In FIGURE 1, the EM-leak within the collective EM-leak (cEM-leak) guarded by two sentential signals (begin/endguard-signal) is called the individual EM-leak (iEM-leak).…”

Section: Introductionmentioning

confidence: 99%

“…The iEM-leak corresponds to an individual machine instruction EM-leak of an MCU. Through the measurement and NN analysis of [8], the program execution sequence can be extracted from the EM-leak analysis.…”

Section: Introductionmentioning

confidence: 99%

“…However, the NN models require a lot of data for NN training and validation. And these data, which are called EMdataset in this paper, should be measured by a special EMleak measurement platform [8]. Thus, generating a "sufficient and complete" EM-dataset is very important for such studies.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Optimized Sequence Dataset Generation for a Two-Stage Pipelined Microcontroller Instruction-Level Electromagnetic Information Leakage Analysis

Yuan

2022

IEEE Access

Self Cite

View full text Add to dashboard Cite

With the prevalence of the Internet of Things (IoT) and microcontrollers (MCUs), the security issues of IoT and MCUs have become increasingly important. Side-channel analysis (SCA) is a major threat to such problems. One of the non-invasive SCAs is through electromagnetic information leakage (EM-leak) analysis. The author has developed a machine-instruction-level EM-leak analysis by neural network (NN) model. The NN model analysis need a large dataset for training and validation. And the dataset should be complete and sufficient. The dataset sufficiency can be achieved by acquiring more data from the already proposed EM-leak measurement platform. However, the completeness issue becomes a challenge due to the pipelined architecture in the target MCU. In this paper, the completeness issue of a NN model dataset for the EM-leak analysis is addressed. The issue is to be solved in several steps. First, it is simplified to a two-stage pipelined MCU individual EM-leak analysis sequence problem (2-EMAseq). The problem is then proved that at least one optimal solution exists. And an algorithm is proposed based on the proof to find an optimal solution (a complete EM-leak NN dataset). Experiments show that the proposed algorithm can find an optimal solution. The contributions of this paper include: it successfully reduces a real problem to a 2-EMAseq description, proves that the 2-EMAseq problem has at least one optimal solution, uses this proof to develop an algorithm, and uses this algorithm to find a complete dataset is the target two-stage pipelined MCU dataset for NN model training/validation. Currently, the algorithm can only generate the optimal EM-dataset for twostage pipelined MCUs. However, there are many MCUs with 4~8 pipeline stages. Whether there is an optimal solution when the stages are more than two is still an open question. And it needs to find proofs or derive heuristics in the future for such MCUs.

show abstract

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Optimized Sequence Dataset Generation for a Two-Stage Pipelined Microcontroller Instruction-Level Electromagnetic Information Leakage Analysis

Yuan

2022

IEEE Access

Self Cite

View full text Add to dashboard Cite

show abstract

Synthetic Aperture Interferometric Passive Radiometer Imaging to Locate Electromagnetic Leakage From Spacecraft Surface

Zhang,

Huang

et al. 2024

IET Circuits, Devices & Systems

View full text Add to dashboard Cite

The localization of electromagnetic radiation leakage through cabin gaps is a critical and challenging aspect of electromagnetic compatibility (EMC) design for spacecraft with complex electromagnetic environments. This paper proposes a localization method based on synthetic aperture interferometric passive radiometry imaging. Electromagnetic radiation signals are measured at a certain distance from the spacecraft surface to form visibility samples. A Fourier transform pair between the visibility sample and the corrected brightness temperature for electromagnetic radiation leakage is established. The spacecraft surface electromagnetic leakage location image is obtained through the inverse Fourier transform. A sparse sampling method based on ant colony optimization was proposed to improve testing efficiency. The impacts of various factors, including positional parameters, positioning accuracy of the test antenna, scanning parameters, and measurement receiver amplitude/phase errors on the imaging results are analyzed. Experiments were conducted on a 1 m × 1 m × 1 m cabin with 51 holes on one surface, and the algorithm proposed in this paper was validated to effectively image and locate electromagnetic leakage points at different frequencies. The effectiveness of sparse sampling was also verified, with a localization accuracy of 90.2% and a testing time savings of 81.9%.

show abstract

A Taxonomy-Based Survey of EM-SCA and Implications for Multi-Robot Systems

Ibrahim,

Kermanshahi,

Kasmarik

et al. 2024

IEEE Open J. Comput. Soc.

View full text Add to dashboard Cite

Identification of Microcontroller Unit Instruction Execution Using Electromagnetic Leakage and Neural Network Classification

Cited by 4 publications

References 48 publications

Optimized Sequence Dataset Generation for a Two-Stage Pipelined Microcontroller Instruction-Level Electromagnetic Information Leakage Analysis

Optimized Sequence Dataset Generation for a Two-Stage Pipelined Microcontroller Instruction-Level Electromagnetic Information Leakage Analysis

Synthetic Aperture Interferometric Passive Radiometer Imaging to Locate Electromagnetic Leakage From Spacecraft Surface

A Taxonomy-Based Survey of EM-SCA and Implications for Multi-Robot Systems

Contact Info

Product

Resources

About