Exploiting Per-Core Leakage: Electromagnetic Side-Channel Monitoring of Multicore Architectures

• Multicore physical side-channel analysis remains underexplored because inter-core interference, signal heterogeneity, and dynamic core assignment complicate leakage acquisition.Source: §1 · p. 1
• External side-channel monitoring is motivated by embedded systems’ resource constraints, zero-overhead requirements, and stealth advantages over on-device security solutions.Source: §1 · p. 1
• Prior multicore monitoring relied on aggregated EM leakage without accounting for multicore leakage mechanisms, resulting in high complexity and unrealistic assumptions.Source: §1 · p. 1
• The paper reveals multicore EM leakage mechanisms and demonstrates per-core leakage exploitation for physical side-channel analysis.Source: §1 · p. 2
• The proposed method uses spectral characterization and an autoencoder-based, core-agnostic monitoring approach implemented on a heterogeneous SoC prototype.Source: §1 · p. 2
• Feasibility is validated on the commercial off-the-shelf Raspberry Pi 4B quad-core system with ARM Cortex-A72 cores.Source: §1 · p. 2

2.1 Prior Work — Single-Core Leakage

• EM leakage from CPU cores mainly arises through amplitude modulation, producing sidebands at f_c ± n·1/T for periodic activity.Source: §2.1 · p. 2

2.2 Sideband Formation and Interpretation

• CMOS switching draws current through on-chip power rails, whose emissions act as carriers modulated by instruction-dependent circuit activity to form distinct sidebands.Source: §2.2 · p. 2
• AM simulations model a non-sinusoidal carrier and arbitrary CPU-power modulator to derive atomic sideband patterns by activity type.Source: Figure 1 · p. 2
• Idle activity suppresses amplitude modulation and sideband formation, producing a clean spectrum with energy concentrated at a few sharp peaks.Source: §2.3 · p. 2
• Jittered-periodic activity spreads sharp spectral peaks into shifted bumps, while irregular activity produces non-repetitive spectral behavior.Source: §2.3 · p. 3

2.3 Spectral Patterns

• Each multicore core draws current from its own on-chip power rail, creating localized EM leakage, but prior work lacked a way to isolate it from inter-core interference.Source: §2.4 · p. 3, Figure 2 · p. 3

• Modeling follows 1 → 2 → 3 → 4 → ×, while monitoring follows × → 2 → 3 → × → 5.Source: §3 · p. 3

Inter-Core Signal Harmonization (ICSH)

• Core Selection Maps use diverse leakage maps and artificial Type-2 sidebands to identify probing conditions that minimize neighboring-core interference.Maps vary coil configuration, especially rotation angle, and are derived with Algorithm 1.Source: §3.2 · p. 3
• ICSH harmonizes signal levels and spectral baselines by adjusting channels to a reference core and deriving gains plus Baseline Adjustment Offsets.The gadget generates artificial Type-2 sidebands as a reference during harmonization.Source: §3.3 · p. 4

Adaptive Interference Suppression (AIS)

• Type-2 sidebands dominate neighboring-core interference because their energy is concentrated into strong, clearly visible spectral components.Other activity types disperse energy more broadly, causing their interference sidebands to be buried in the noise floor.Source: §3.4 · p. 4
• AIS estimates an Interference Matrix from synchronized per-core signals and suppresses interference frame by frame, processing cores from least to most affected.Matrix values represent neighboring-core sideband magnitude relative to self-core activity, from 0 to 1.Source: §3.4 · p. 4

High-Coverage Spectral Modeling

• A vanilla autoencoder models individual FFT-frame reconstruction error, flagging high-error frames as anomalies without intermediate state abstractions.Source: §3.5 · pp. 4–5

Core-Agnostic Architecture

• A single reference model removes structural boundaries across cores, so task assignment and migration do not affect monitoring and load balancing need not be considered.Source: §3.6 · p. 5

Implementation

• The prototype combines AMD’s ZCU102 heterogeneous SoC with Analog Devices’ FMComms5 four-channel RF front-end for synchronized signal acquisition and preprocessing.Source: §4.1 · p. 5

Target Platform

• The Raspberry Pi 4B evaluation uses a BCM2711 with four ARM Cortex-A72 cores, fixed 600 MHz operation, 10 MS/s sampling, and 300 𝜇m-resolution near-field probing.Source: §4.2 · p. 5

Per-Core Distinguishability

• Four probing setups produce 16 per-core leakage maps, which form M_L for deriving M_cs and the Interference Matrix.Source: §4.3 · p. 5
• Interference suppression follows the least-affected-core order Core 1→3→0→2.Source: §4.3 · p. 5

Per-Core Monitoring

• The workload suite runs Susan, Basicmath, MLP inference, and AES in parallel, while an autoencoder models approximately 0.2 ms FFT frames.Source: §4.4 · p. 6
• At SMA=15 ms, all four cores achieve an AUC above 0.995, including benign workloads remapped to cores different from those used during modeling.Source: §4.4 · p. 6, Figure 9 · p. 6

• DPP requires high-precision physical positioning, making setup costly, cumbersome, and vulnerable to spatial deviations.Source: §5 · p. 6
• Custom-built precision probes, handcrafted coils, and a harness based on M𝑐𝑠 can mitigate positioning deviations.Source: §5 · p. 6
• Repeatedly opening the enclosure for monitoring can be inefficient and raise EMC or MIL-STD-461 compliance concerns.Source: §5 · p. 6
• Enclosure-level signal measurement ports allow external instrument connection while retaining internal probing through a harness.Source: §5 · p. 6

6 Conclusion and Future Work

• The work unveils multicore EM leakage mechanisms and establishes the feasibility of per-core leakage exploitation.Source: §6 · p. 6
• A prototype implements multicore side-channel monitoring and validates its effectiveness on an off-the-shelf quad-core embedded platform.Source: §6 · p. 6
• Per-core leakage exploitation, previously considered infeasible, is expected to facilitate broader EM-based side-channel analysis on modern multicore platforms.Source: §6 · p. 6
• Future work includes improving the monitoring method, extending support to DVFS-capable systems, and integrating inference models into the FPGA fabric.Source: §6 · p. 6