Source-linked AI summary
Exploiting Per-Core Leakage: Electromagnetic Side-Channel Monitoring of Multicore Architectures
Daehyeon Bae, Sujin Park, Insup Lee, YoungGiu Jung, Kyeongsik Lee, HeeSeok Kim, Seokhie Hong
TL;DR
Physical side-channel analysis of multicore embedded systems lacks usable leakage because multicore interference and system dynamics complicate acquisition. The paper reveals multicore EM leakage mechanisms, demonstrates per-core exploitation, and develops a non-intrusive monitoring method validated with a prototype and Raspberry Pi 4B. These results establish the feasibility of per-core leakage exploitation for multicore platforms.
Problem
Multicore physical side-channel analysis remains underexplored because obtaining usable leakage is complicated by inter-core interference, signal heterogeneity, and dynamic core assignment.
Method
The paper analyzes multicore EM leakage, uses fine-grained multi-probing and spectral characterization, and develops a core-agnostic monitoring method with prototype validation.
Results
The work demonstrates per-core EM leakage exploitation and validates a prototype side-channel monitoring method on a commercial off-the-shelf quad-core embedded platform.
Takeaways & Limitations
Per-core leakage exploitation establishes the feasibility of physical side-channel analysis and supports broader EM-based analysis of modern multicore platforms.
Takeaways & Limitations
The approach assumes a profiling device that can execute the target software under matching conditions and run core-affine instruction gadgets.
Abstract
from arXiv · showhide
Multicore processors are increasingly adopted in embedded systems to meet growing performance demands. However, physical side-channel analysis of multicore architectures remains underexplored, as obtaining usable leakage is inherently challenging. Consequently, side-channel security research on such systems has lagged far behind, leaving a critical security gap. To address this gap, we reveal the electromagnetic leakage mechanisms in multicore architectures and, for the first time, demonstrate per-core leakage exploitation, thereby enabling physical side-channel analysis for these systems. As a practical extension, we present a non-intrusive side-channel monitoring method that achieves per-core granularity. To validate its feasibility and practicality, we implement a prototype on a heterogeneous SoC platform with an RF front-end, and evaluate on a commercial off-the-shelf quad-core embedded system, the Raspberry Pi 4B with ARM Cortex-A72 cores.
1 Introduction
Multicore side-channel analysis is difficult because leakage is interfered, heterogeneous, and dynamically assigned across cores, while embedded systems still need external monitoring. This work addresses the gap by exploiting per-core EM leakage and validating a core-agnostic monitoring method on a quad-core platform.
- Multicore physical side-channel analysis remains underexplored because inter-core interference, signal heterogeneity, and dynamic core assignment complicate leakage acquisition.
- External side-channel monitoring is motivated by embedded systems’ resource constraints, zero-overhead requirements, and stealth advantages over on-device security solutions.
- Prior multicore monitoring relied on aggregated EM leakage without accounting for multicore leakage mechanisms, resulting in high complexity and unrealistic assumptions.
- The paper reveals multicore EM leakage mechanisms and demonstrates per-core leakage exploitation for physical side-channel analysis.
- The proposed method uses spectral characterization and an autoencoder-based, core-agnostic monitoring approach implemented on a heterogeneous SoC prototype.
- Feasibility is validated on the commercial off-the-shelf Raspberry Pi 4B quad-core system with ARM Cortex-A72 cores.
2 EM Leakage in Multicore Architectures
CPU activity produces EM sidebands through amplitude modulation of emissions associated with on-chip power delivery, and their spectral forms reflect activity types. In multicore processors, localized power-rail leakage offers a basis for per-core analysis, but interference has hindered isolation.
- 2.1 Prior Work — Single-Core Leakage: EM leakage from CPU cores mainly arises through amplitude modulation, producing sidebands at f_c ± n·1/T for periodic activity.
- 2.2 Sideband Formation and Interpretation: CMOS switching draws current through on-chip power rails, whose emissions act as carriers modulated by instruction-dependent circuit activity to form distinct sidebands.
- 2.2 Sideband Formation and Interpretation: AM simulations model a non-sinusoidal carrier and arbitrary CPU-power modulator to derive atomic sideband patterns by activity type.
- 2.2 Sideband Formation and Interpretation: Idle activity suppresses amplitude modulation and sideband formation, producing a clean spectrum with energy concentrated at a few sharp peaks.
- 2.2 Sideband Formation and Interpretation: Jittered-periodic activity spreads sharp spectral peaks into shifted bumps, while irregular activity produces non-repetitive spectral behavior.
- 2.3 Spectral Patterns: Each multicore core draws current from its own on-chip power rail, creating localized EM leakage, but prior work lacked a way to isolate it from inter-core interference.
3 Proposed Method
The proposed method combines per-core leakage acquisition, signal harmonization, adaptive interference suppression, high-coverage spectral modeling, and a core-agnostic monitoring architecture. It separates modeling and monitoring workflows while accommodating dynamic core assignment under the stated embedded-system assumptions.
- Modeling follows 1 → 2 → 3 → 4 → ×, while monitoring follows × → 2 → 3 → × → 5.
- Inter-Core Signal Harmonization (ICSH): Core Selection Maps use diverse leakage maps and artificial Type-2 sidebands to identify probing conditions that minimize neighboring-core interference.Maps vary coil configuration, especially rotation angle, and are derived with Algorithm 1.
- Inter-Core Signal Harmonization (ICSH): ICSH harmonizes signal levels and spectral baselines by adjusting channels to a reference core and deriving gains plus Baseline Adjustment Offsets.The gadget generates artificial Type-2 sidebands as a reference during harmonization.
- Adaptive Interference Suppression (AIS): Type-2 sidebands dominate neighboring-core interference because their energy is concentrated into strong, clearly visible spectral components.Other activity types disperse energy more broadly, causing their interference sidebands to be buried in the noise floor.
- Adaptive Interference Suppression (AIS): AIS estimates an Interference Matrix from synchronized per-core signals and suppresses interference frame by frame, processing cores from least to most affected.Matrix values represent neighboring-core sideband magnitude relative to self-core activity, from 0 to 1.
- High-Coverage Spectral Modeling: A vanilla autoencoder models individual FFT-frame reconstruction error, flagging high-error frames as anomalies without intermediate state abstractions.
- Core-Agnostic Architecture: A single reference model removes structural boundaries across cores, so task assignment and migration do not affect monitoring and load balancing need not be considered.
4 Implementation and Evaluation
The authors implement synchronized multi-channel acquisition with a ZCU102 and FMComms5 prototype, then evaluate per-core monitoring on a four-core Raspberry Pi 4B. The evaluation combines leakage-map construction, interference characterization, remapped benign workloads, and injected anomalies.
- Implementation: The prototype combines AMD’s ZCU102 heterogeneous SoC with Analog Devices’ FMComms5 four-channel RF front-end for synchronized signal acquisition and preprocessing.
- Target Platform: The Raspberry Pi 4B evaluation uses a BCM2711 with four ARM Cortex-A72 cores, fixed 600 MHz operation, 10 MS/s sampling, and 300 𝜇m-resolution near-field probing.
- Per-Core Distinguishability: Four probing setups produce 16 per-core leakage maps, which form M_L for deriving M_cs and the Interference Matrix.
- Per-Core Distinguishability: Interference suppression follows the least-affected-core order Core 1→3→0→2.
- Per-Core Monitoring: The workload suite runs Susan, Basicmath, MLP inference, and AES in parallel, while an autoencoder models approximately 0.2 ms FFT frames.
- Per-Core Monitoring: At SMA=15 ms, all four cores achieve an AUC above 0.995, including benign workloads remapped to cores different from those used during modeling.
5 Discussion
The discussion identifies practical deployment constraints for DPP-based monitoring and proposes enclosure-level measurement ports as a less cumbersome alternative.
- DPP requires high-precision physical positioning, making setup costly, cumbersome, and vulnerable to spatial deviations.
- Custom-built precision probes, handcrafted coils, and a harness based on M𝑐𝑠 can mitigate positioning deviations.
- Repeatedly opening the enclosure for monitoring can be inefficient and raise EMC or MIL-STD-461 compliance concerns.
- Enclosure-level signal measurement ports allow external instrument connection while retaining internal probing through a harness.
6 Conclusion and Future Work
The work reveals multicore EM leakage mechanisms, demonstrates per-core leakage exploitation, and develops a prototype side-channel monitor validated on a quad-core embedded platform. It positions per-core exploitation as a basis for broader EM-based analysis while identifying future extensions for DVFS support and end-to-end FPGA execution.
- 6 Conclusion and Future Work: The work unveils multicore EM leakage mechanisms and establishes the feasibility of per-core leakage exploitation.
- 6 Conclusion and Future Work: A prototype implements multicore side-channel monitoring and validates its effectiveness on an off-the-shelf quad-core embedded platform.
- 6 Conclusion and Future Work: Per-core leakage exploitation, previously considered infeasible, is expected to facilitate broader EM-based side-channel analysis on modern multicore platforms.
- 6 Conclusion and Future Work: Future work includes improving the monitoring method, extending support to DVFS-capable systems, and integrating inference models into the FPGA fabric.