PaperlayerView exact revision on arXiv

Source-linked AI summary

A Survey of Electromagnetic Side-Channel Attacks and Discussion on their Case-Progressing Potential for Digital Forensics

Asanka Sayakkara, Nhien-An Le-Khac, Mark Scanlon

arXiv:1903.07703v1cs.CR

TL;DR

IoT devices are increasingly relevant to digital forensics, but their limited interfaces and the paper's broader focus on encrypted devices make forensic analysis challenging. The paper reviews EM side-channel research and its applicability to IoT investigations. It identifies potential forensic applications and future avenues, while noting that the field still needs forensically sound, court-admissible processing.

  • Problem

    IoT devices have limited standard interfaces, and the paper addresses how EM side-channel analysis may assist their forensic investigation.

    Source: §1 · pp. 1–2

  • Method

    The paper comparatively reviews EM side-channel research and identifies applications and future research avenues for IoT digital forensics.

    Source: §1 · p. 2

  • Results

    The review identifies applicable forensic scenarios and future avenues, including potential use of AI to extract more information from EM traces than manual observations.

    Source: §1 · p. 2, §7 · p. 10

  • Takeaways & Limitations

    EM side-channel analysis has potential to progress stalled investigations involving IoT and encrypted computing devices.

    Source: §8 · pp. 10–11

    EM side-channel analysis remains in its infancy for forensics, requiring court-admissible, forensically sound processing for key recovery and leakage detection.

    Source: §8 · p. 10

Abstract

from arXiv · show

The increasing prevalence of Internet of Things (IoT) devices has made it inevitable that their pertinence to digital forensic investigations will increase into the foreseeable future. These devices produced by various vendors often posses limited standard interfaces for communication, such as USB ports or WiFi/Bluetooth wireless interfaces. Meanwhile, with an increasing mainstream focus on the security and privacy of user data, built-in encryption is becoming commonplace in consumer-level computing devices, and IoT devices are no exception. Under these circumstances, a significant challenge is presented to digital forensic investigations where data from IoT devices needs to be analysed. This work explores the electromagnetic (EM) side-channel analysis literature for the purpose of assisting digital forensic investigations on IoT devices. EM side-channel analysis is a technique where unintentional electromagnetic emissions are used for eavesdropping on the operations and data handling of computing devices. The non-intrusive nature of EM side-channel approaches makes it a viable option to assist digital forensic investigations as these attacks require, and must result in, no modification to the target device. The literature on various EM side-channel analysis attack techniques are discussed - selected on the basis of their applicability in IoT device investigation scenarios. The insight gained from the background study is used to identify promising future applications of the technique for digital forensic analysis on IoT devices - potentially progressing a wide variety of currently hindered digital investigations.

1. Introduction

IoT devices are increasingly relevant to forensic investigations, yet limited interfaces and built-in encryption complicate access to their data. This paper reviews EM side-channel research for forensic applications, identifying applicable scenarios, research opportunities, and a shortage of reliable tools and frameworks.

1. Introduction

  • Limited interfaces and built-in encryption complicate forensic analysis of IoT devices that are increasingly found in crime scenes.IoT devices commonly have limited processing and storage capabilities and fewer standard interfaces than PCs.Source: §1 · p. 1
  • EM emissions can be passively observed to infer device operations and handled data with minimal physical manipulation, aligning with forensic efforts to avoid changing evidence.The authors note that manufacturers attempt to counter these vulnerabilities through EM shielding and firmware obfuscation.Source: §1 · p. 2
  • The paper provides a comparative literature review of EM side-channel research and evaluates recovery of cryptographic keys and other information for IoT forensics.Power-analysis literature is also discussed where relevant because EM emissions are associated with device power consumption.Source: §1 · p. 2
  • The review identifies forensic scenarios for EM attacks, promising research avenues, and a shortage of reliable IoT forensic tools and frameworks.It also recommends ways to address the tool and framework shortage.Source: §1 · p. 2

2. Side-Channel Attacks

Side-channel attacks exploit unintended information leakage from computer systems, including timing, cache use, sound, power, and EM radiation. The section outlines how observations of such leakage can reveal program behavior or sensitive information, including cryptographic keys.

2. Side-Channel Attacks

  • Side-channel attacks exploit unintended information leakage from hardware or software, with examples including shared memory and cache, timing, sound, power, and EM radiation.Combining channels that leak different information, such as power and EM analysis, can reduce errors and improve inference accuracy.Source: §2 · pp. 2–3
  • Execution-time measurements can expose input-dependent behavior in encryption, including key bits in RSA, while shared-cache observations can expose information across virtual machines.The RSA example relies on repeated timing observations with the same key and different inputs; shared physical cache lets one VM spy on another.Source: §2 · p. 2
  • Acoustic emanations can distinguish CPU operations and have been used to attack RSA keys, while display and cable emissions can support image reconstruction.Display reconstruction uses horizontal and vertical synchronization information in EM emissions.Source: §2 · pp. 2–3
  • Simple power analysis (SPA) observes power variation over time; DES instruction patterns can reveal operation sequences that depend on handled data.Minimizing data-dependent branching can prevent recognition of characteristic operation patterns.Source: §2 · p. 3
  • Differential power analysis (DPA) can be tailored to an encryption algorithm and, with sufficient ciphertexts and power traces, can accurately guess a DES key.The authors also report its use in reverse engineering algorithms and protocols and suggest that the process may be automated.Source: §2 · p. 3

3. Unintentional Electromagnetic Emissions

Unintended EM emissions arise from changing currents in computing hardware and can carry information about software execution and data handling. The section describes relevant sources, capture approaches, and the relationship between CPU activity and observable emissions.

3. Unintentional Electromagnetic Emissions

  • Changing electric currents generate EM waves, and unintended emissions from digital components cannot be entirely avoided despite manufacturers' efforts to minimize them.The section surveys emission sources, information they may carry, and methods and tools for capturing signals.Source: §3.1 · p. 3, §3 · p. 3

3.1. Hardware that Causes Electromagnetic Emissions

  • CPU and RAM emissions can contain side-channel information about software execution and data handling; on most IoT devices, both reside in MCU chips.The CPU fetches, decodes, and executes instructions while RAM maintains data and instructions when powered on.Source: §3.1 · p. 3

3.2. Sampling Electromagnetic Emissions

  • Capturing EM emissions requires suitable antennas and high-rate digitization; software-defined radios can scan a range of RF frequencies to locate candidate emissions.The required sample rate is theoretically at least twice the maximum frequency being captured, and SDR processing is handled in software.Source: §3.2 · pp. 3–4
  • An Arduino experiment showed different EM signal patterns for simple and complex LED programs, with a distinct pattern during reprogramming.The RTL-SDR setup observed the Arduino clock's first harmonic at 32 MHz because the dongle could not tune below 22 MHz.Source: §3.2 · p. 4, Figure 1 · p. 4

3.3. Connection Between CPU Instructions and Electromagnetic Emissions

  • CPU instruction combinations produce EM patterns at varying frequencies and amplitudes, making processor emissions difficult to model and their interpretation time-consuming and manual.The practical approach described is to scan a broad frequency spectrum for suspected signals and then inspect them for side-channel information.Source: §3.3 · p. 4
  • SAVAT measures EM signal power from specific CPU instruction pairs, while FASE detects sidebands around a periodic signal when program activity modulates it.Further SAVAT developments enabled identification of both amplitude- and frequency-modulated CPU emissions; the effects of CPU architecture require further study.Source: §3.3 · p. 4

4. Electromagnetic Emissions as a Signature

EM emissions reflect both device hardware and software execution, creating possible signatures for distinguishing devices, software, and execution behavior. RF-DNA fingerprinting converts an acquired trace into a statistical feature vector.

4. Electromagnetic Emissions as a Signature

  • 32 MHz system-clock harmonics vary with device changes, while instruction sequences also significantly influence Arduino EM patterns.PCB design and electronic-component characteristics contribute variations to the strong clock signal.Source: §4 · p. 5

4.1. Electromagnetic Emissions as a Hardware Signature

  • Distinctive EM patterns can reveal hardware alterations and counterfeit devices, including counterfeits designed to follow the genuine device’s design.Such altered patterns may help identify hardware modifications or replacements.Source: §4.1 · p. 5

4.2. Electromagnetic Emissions as a Software Signature

  • Uninstrumented EM observations can identify software execution sequences and help detect deviations associated with bugs, faults, or attacks.The cited studies report detecting abnormal execution patterns from corresponding EM emissions.Source: §4.2 · p. 5
  • Although RF-DNA has been applied to unintentional EM emissions, evaluations on microcontroller-based IoT devices leave the most reliable signal format unresolved.The literature also reports RF-DNA applications for identifying rogue radio devices and fingerprinting computing-device emissions.Source: §4.2 · p. 5
  • RF-DNA fingerprinting represents captured EM emissions as a vector of statistical features computed from amplitude, phase, and frequency across signal regions.The process also computes the same statistics over the entire trace as an additional region.Source: §4.2 · pp. 5–6, Figure 2 · p. 6

5. Information Leaking Electromagnetic Emissions

EM traces can expose software behavior and data, including cryptographic information, through visual inspection or differential analysis. Research also reports attacks on wireless-powered devices, while countermeasures remain unevenly studied.

5. Information Leaking Electromagnetic Emissions

  • EM side-channel analysis may reveal software behavior and critical data such as cryptographic keys, even when it does not recover all data handled by an IoT platform.The section frames these disclosures as potentially useful to forensic analysis.Source: §5 · p. 6

5.1. Observable Electromagnetic Spectrum Patterns

  • SEMA examines time-domain traces, while spectrograms can reveal signal patterns distributed across frequencies; published SEMA studies report extracting cryptographic information, including from ECC algorithms used on IoT platforms.The cited works describe attacks on El Gamal, RSA, ECDH, and ECDSA implementations.Source: §5.1 · p. 6

5.2. Differential Electromagnetic Analysis (DEMA)

  • DEMA uses register-transition emissions to infer Hamming distances and identify instructions or intermediate variables; XOR-key analysis compares hypothetical and measured matrices using cross-correlations.In practice, attacks on key chunks may leave multiple candidate chunks, a key-enumeration problem the cited work says can be solved with reasonable computational overhead.Source: §5.2 · pp. 6–7
  • Published DEMA studies report key extraction from smartcard chips, including DES and RSA, and describe key recovery despite White Box Cryptography; screaming channels can extend CPU leakage through radio emissions.For wireless-powered devices, RFID attacks have recovered AES, DES, 3-DES, and 3DES keys, although one AES proof of concept separated the circuitry from the power-harvesting antenna, unlike a regular tag.Source: §5.2 · p. 7, §5.3 · p. 8

5.3. Analysis on Wireless-Powered Devices

  • Strong reader RF fields can obscure weak emissions from wireless-powered devices, but studies report attacks on RFID tags and smart-cards in reader fields, including recovery of DES and 3-DES keys.Software masking has not proved sufficiently effective against EM attacks, while several other software and hardware countermeasures require further study or are described as design options.Source: §5.3 · pp. 7–8, §5.4 · p. 8

6. Standards and Tools

The paper describes a gap in forensic-specific standards and tools for EM side-channel analysis. It reviews relevant security-domain examples and argues for coordinated standards and assessment frameworks.

6. Standards and Tools

  • EM side-channel attacks are not commonly used in digital forensics, and the paper reports no established forensic-specific standards or tools.It recommends reviewing hardware- and software-security standards and tools as groundwork for future forensic standards and tools.Source: §6 · p. 8
  • EMC authorities and requirements address unintentional emissions, but the paper reports no rules governing EM side-channel information leakage from general-purpose electronic devices.For this leakage, only guidelines exist, and they may not be followed.Source: §6 · p. 8
  • The authors argue that minimizing emissions should begin in hardware design and that hardware and software developers should jointly establish standards.They note that late manufacturing changes can require PCB rework or component replacement, and cite TVLA, TempestSDR, ChipWhisperer, Riscure Inspector, and SCAP among relevant assessment tools and frameworks.Source: §6 · p. 9

7. Discussion

The discussion identifies possible forensic uses of EM analysis, including live observation of cryptographic operations and analysis of emissions in other settings. It also points to combined side channels and AI as research directions.

7. Discussion

  • Live EM analysis could observe cryptographic operations, but attacks require many traces acquired while the victim device performs operations using a single key.The paper notes that encrypted storage and communications can make forensic information inaccessible.Source: §7 · pp. 9–10
  • Combining power and EM side channels may yield better results because CPU operations can be more clearly reflected in one channel than the other.The paper also describes malware that intentionally modulates data into CPU or monitor emissions as a possible aid to an EM attacker.Source: §7 · p. 10
  • Backscatter communication raises the possibility of using ambient RF sources to eavesdrop on internal CPU operations of IoT devices, a direction the paper says warrants further exploration.The cited literature tested carrier sources including TV transmissions and WiFi access points.Source: §7 · p. 10
  • EM emissions from routers and switches have been used to extract Ethernet MAC addresses and might provide an approximate picture of live network workload and traffic.The paper contrasts this possibility with packet inspection, which requires a connection to the live wired network.Source: §7 · p. 10
  • AI could automate EM-trace analysis that previously required human intervention, while cited work applied power-side-channel deep learning to anomaly detection on simple IoT devices.The paper suggests AI may extract more information from EM traces than current manual observations.Source: §7 · p. 10

8. Conclusions

Cryptographically protected storage and communications challenge forensic analysis, while EM side-channel analysis offers a potential route to access them. The review says forensic use remains nascent and requires court-admissible, forensically sound processing, but may advance stalled IoT and encrypted-device investigations.

8. Conclusions

  • EM side-channel analysis may help open cryptographically protected storage and communications to forensic analysis.The paper frames this as a potential application building on demonstrated security uses.Source: §8 · p. 10
  • Forensic EM side-channel use remains in its infancy and requires court-admissible, forensically sound processing for key recovery and data-leakage detection.The processing requirement applies to both obtaining security keys and detecting unintentional data leakage.Source: §8 · p. 10
  • The technique has potential to advance stalled investigations involving IoT devices and encrypted computing devices more broadly.Source: §8 · pp. 10–11
  • Existing mitigation techniques have not successfully reduced the prevalence of EM side-channel attacks.Source: §8 · p. 10

APPENDIX

The appendix points to a categorization of EM side-channel literature in Table 1.

APPENDIX

  • Table 1 lists a categorization of the literature on EM side-channels.Source: APPENDIX · p. 11
Loading 1903.07703v1…