Side-Channel Attacks & Data Exfiltration Using Wall Outlet USB Power Adapters

The number and creativity of side channel attacks have increased dramatically in recent years. Of particular interest are attacks leveraging power line communication to 1) gather information on power consumption from the victim and 2) exfiltrate data from compromised machines. Attack strategies of this nature on the greater power grid and building infrastructure levels have been shown to be a serious threat. This project further explores this concept of a novel attack vector by creating a new type of penetration testing tool: an USB power adapter capable of remote monitoring of device power consumption and communicating through powerline communications.

An Effective and Scalable VM Migration Strategy to Mitigate Cross-VM Side-Channel Attacks in Cloud

Co-residency of virtual machines(VMs) of different tenants on the same physical platform would possibly lead to cross-VM side-channel attacks in the cloud. While most of current countermeasures fail for real or immediate deployment due to their requirement for modification of virtualization structure, we adopt dynamic migration, an inherent mechanism of the cloud platform, as a general defense against this kind of threats. To this end, we first set up a unified practical information leakage model which shows the factors affecting side channels and describes the way they influence the damage due to side-channel attacks. Since migration is adopted to limit the time duration of co-residency, we envision this defense as an optimization problem by setting up an Integer Linear Programming(ILP) to calculate optimal migration strategy, which is intractable due to high computational complexity. Therefore, we approximate the ILP with a baseline genetic algorithm, which is further improved for its optimality and scalability. Experimental results show that our migration-based defense can not only provide excellent security guarantees and affordable performance cost in both theoretical simulation and practical cloud environment, but also achieve better optimality and scalability than previous countermeasures.

Secure and efficient elliptic curve cryptography resists side-channel attacks

An embedded cryptosystem needs higher reconfiguration capability and security. After analyzing the newly emerging side-channel attacks on elliptic curve cryptosystem （ECC）, an efficient fractional width-w NAF （FWNAF） algorithm is proposed to secure ECC scalar multiplication from these attacks. This algorithm adopts the fractional window method and probabilistic SPA scheme to reconfigure the pre-computed table, and it allows designers to make a dynamic configuration on pre-computed table. And then, it is enhanced to resist SPA, DPA, RPA and ZPA attacks by using the random masking method. Compared with the WBRIP and EBRIP methods, our proposals has the lowest total computation cost and reduce the shake phenomenon due to sharp fluctuation on computation performance.

Security Control for Uncertain Networked Control Systems under DoS Attacks and Fading Channels

This paper characterizes the joint effects of plant uncertainty,Denial-of-Service(DoS)attacks,and fading channel on the stabilization problem of networked control systems(NCSs).It is assumed that the controller remotely controls the plant and the control input is transmitted over a fading channel.Meanwhile,considering the sustained attack cycle and frequency of DoS attacks are random,the packet-loss caused by DoS attacks is modelled by a Markov process.The sampled-data NCS is transformed into a stochastic form with Markov jump and uncertain parameter.Then,based on Lyapunov functional method,linear matrix inequality(LMI)-based sufficient conditions are presented to ensure the stability of uncertain NCSs.The main contribution of this article lies in the construction of NCSs based on DoS attacks into Markov jump system(MJS)and the joint consideration of fading channel and plant uncertainty.

Randomized MILP framework for Securing Virtual Machines from Malware Attacks

Cloud computing involves remote server deployments with public net-work infrastructures that allow clients to access computational resources.Virtual Machines(VMs)are supplied on requests and launched without interactions from service providers.Intruders can target these servers and establish malicious con-nections on VMs for carrying out attacks on other clustered VMs.The existing system has issues with execution time and false-positive rates.Hence,the overall system performance is degraded considerably.The proposed approach is designed to eliminate Cross-VM side attacks and VM escape and hide the server’s position so that the opponent cannot track the target server beyond a certain point.Every request is passed from source to destination via one broadcast domain to confuse the opponent and avoid them from tracking the server’s position.Allocation of SECURITY Resources accepts a safety game in a simple format as input andfinds the best coverage vector for the opponent using a Stackelberg Equilibrium(SSE)technique.A Mixed Integer Linear Programming(MILP)framework is used in the algorithm.The VM challenge is reduced by afirewall-based controlling mechanism combining behavior-based detection and signature-based virus detection.The pro-posed method is focused on detecting malware attacks effectively and providing better security for the VMs.Finally,the experimental results indicate that the pro-posed security method is efficient.It consumes minimum execution time,better false positive rate,accuracy,and memory usage than the conventional approach.

An Efficient Method against Side-Channel Attacks on ECC

Side-channel attacks （SCA） may exploit leakage information to break cryptosystems. In this paper we present a new SCA resistant Elliptic Curve scalar multiplication algorithm. The proposed algorithm, builds a sequence of bit-strings representing the scalar k, characterized by the fact that all bit-strings are different from zero; this property will ensure a uniform computation behavior for the algorithm, and thus will make it secure against simple power analysis attacks （SPA）. With other randomization techniques, the proposed countermeasures do not penalize the computation time. The proposed scheme is more efficient than MOEller＇s one, its cost being about 5% to 10% smaller than MOEller＇s one.

Performance of Analysis Cognitive Radio with Cooperative Sensing under Malicious Attacks over Nakagami Faded Channels

The different realistic propagation channels are faced frequently the multipath fading environments. The main goal of this system design (cognitive radio network) is to improve the efficiency of spectrum access on a non-interfering basis. This system achieves high utilization for the limited spectrum in order to fulfill needs for all users’ demands which are considered as a problem in wireless communications due to rapidly increasing in wireless applications and service. This system is exposed to attack due to the vulnerabilities existence in this system. So, the main outcome of this paper is to investigate the performance of the cooperative sensing in cognitive radio networks under malicious attacks over different channel impairments, and to illustrate the most suitable individual probability of detection in real faded channel by using Nakagami model. This paper illustrates the effectiveness of the attacks and fading on the performance of spectrum sensing process.

A Unified Method Based on SPA and Timing Attacks on the Improved RSA

Nowadays the modular multiplications in many kinds of smartcards are utilized Montgomery's algorithm modular multiplier, so traditional SPA to RSA becomes invalid. An improved attack method is proposed based on SPA which just depends on the fact that there exist some subtle differences in each loop during the operation of cd mod n. At same time, compared with the traditional SPA, it doesn't need to select the clear text or some known message. Using this method, attacks can easy to discover the mode of RSA implementation and extract the bits of decryption key just based on a few collected traces. From the real attack test on several main kinds of smartcard, the private keys of RSA stored inside can be analyzed successfully.

Resistance against side channel attack for RSA cryptosystem

Based on the structure of the side channel attacks （SCAs） to RSA cryptosystem can resist the fault attack and combine with the randomization method for the message and secret exponent, a new implementation scheme of CRT-based （the Chinese remained theorem） RSA is proposed. The proposed scheme can prevent simple power analysis （SPA）, differential power analysis （DPA） and time attack, and is compatible with the existing RSA-CRT cryptosystem as well. In addition, an improvement for resisting fault attack is proposed, which can reduce extra computation time.

Invariant of Enhanced AES Algorithm Implementations Against Power Analysis Attacks

The security of Internet of Things(IoT)is a challenging task for researchers due to plethora of IoT networks.Side Channel Attacks(SCA)are one of the major concerns.The prime objective of SCA is to acquire the information by observing the power consumption,electromagnetic(EM)field,timing analysis,and acoustics of the device.Later,the attackers perform statistical functions to recover the key.Advanced Encryption Standard(AES)algorithm has proved to be a good security solution for constrained IoT devices.This paper implements a simulation model which is used to modify theAES algorithm using logicalmasking properties.This invariant of the AES algorithm hides the array of bits during substitution byte transformation of AES.This model is used against SCAand particularly Power Analysis Attacks(PAAs).Simulation model is designed on MATLAB simulator.Results will give better solution by hiding power profiles of the IoT devices against PAAs.In future,the lightweight AES algorithm with false key mechanisms and power reduction techniques such as wave dynamic differential logic(WDDL)will be used to safeguard IoT devices against side channel attacks by using Arduino and field programmable gate array(FPGA).

基于多源数据聚合的神经网络侧信道攻击

基于深度学习的侧信道攻击需要针对密码算法的每一个密钥字节建模并训练,数据采集和模型训练开销大.针对该问题,提出一种基于多源数据聚合的神经网络侧信道攻击方法.为筛选具有良好泛化效果的密钥字节泄露数据进行数据聚合,以AES-128算法为例,先基于16个密钥字节的泄露数据训练16个单密钥字节模型,分别实现对16个密钥字节的恢复;其次,设计一种打分机制评估各单密钥字节模型的泛化效果,通过得分排序筛选出对各密钥字节恢复效果最好的单密钥字节模型;最后,以筛选模型所对应的各密钥字节泄露数据集构建多源数据聚合模型进行训练,实现密钥恢复.实验测试结果表明,多源数据聚合模型具有良好的泛化效果,有效提高了密钥恢复的准确率和效率,降低了恢复密钥所需的能量迹数量,其在采集能量迹较少的情况下依然具有较好的攻击效果.

面向SIMD指令集的SM4算法比特切片优化

SM4算法是中国自主设计的商用分组密码算法,其加解密计算性能成为影响信息系统数据机密性保障的重要因素之一.现有SM4算法优化主要面向硬件设计和软件查表等方向展开研究,分别存在依赖特定硬件环境、效率低下且易遭受侧信道攻击等问题.比特切片技术通过对输入数据重组实现了并行化高效分组密码处理,可以抵御针对缓存的侧信道攻击.然而现有切片分组密码研究对硬件平台相关性强、处理器架构支持单一,并且并行化处理流水启动较慢,面向小规模数据的加解密操作难以充分发挥单指令多数据(single instruction multiple data,SIMD)等先进指令集的优势.针对上述问题,首先提出了一种跨平台的通用切片分组密码算法模型,支持面向不同的处理器指令字长提供一致化的通用数据切片方法.在此基础上,提出了一种面向SIMD指令集的细粒度切片并行处理SM4优化算法,通过细粒度明文切片重组与线性处理优化有效缩短算法启动时间.实验结果表明,相比通用SM4算法,优化的SM4比特切片算法加密速率最高可达438.0 MBps,加密每字节所需的时钟周期最快高达7.0 CPB(cycle/B),加密性能平均提升80.4%~430.3%.

云存储抗边信道攻击的密文数据去重算法

考虑云储存中密文数据相似性较高,导致去重难度过大的问题,提出一种基于执行机构的密文数据去重算法。构建密文动态平衡跳跃表,根据对动态平衡跳跃表的构建与描述,得到抗边信道攻击的密文数据动态叠加特点。基于密文动态平衡跳跃表构建与更新结果,提出一种抗边信道攻击的数据去重框架,云储存提供商执行数据加密、数据标签查询以及数据去重三个过程。云端储存使用标签代表数据查询操作,一旦查询计数超过阈值,执行数据加密程序对该文件进行加密,并按照云储存服务商提供的执行命令对重叠密文进行去重。实验结果证明,所提方法对密文数据去重效果表现较佳,去重后云储存空间占用情况得到了明显改善。

温针灸联合西药治疗风寒袭络型周围性面瘫疗效观察及对面神经功能、表情肌弹性的影响

目的:观察温针灸联合西药治疗风寒袭络型周围性面瘫的疗效及对面神经功能和表情肌弹性的影响。方法:选取94例周围性面瘫患者,按随机数字表法分为观察组及对照组各47例。对照组予以西药治疗,观察组在对照组基础上实施温针灸治疗。2组疗程均为2周。比较2组临床疗效,比较2组治疗前后中医证候评分、面肌表面肌电图指标值、面动脉血流动力学指标值[面动脉舒张末期流速(Vd)、收缩期峰值流速(Vs)、阻力指数(RI)]、表情肌弹性模量值、House-Brackmann(H-B)评分、面部残疾指数躯体功能评分(FDIS)的变化。结果:观察组临床疗效总有效率为95.74%,对照组为82.98%,2组临床疗效比较,差异有统计学意义(P<0.05)。治疗后,2组口角歪斜、面肌瘫痪、眼不能闭、鼻唇沟变浅、味觉减退、耳后疼痛中医证候评分均较治疗前下降(P<0.05),观察组上述6项评分均低于对照组(P<0.05)。治疗后,2组额肌、眼轮匝肌、口轮匝肌表面肌电信号潜伏期均较治疗前缩短,波幅均较治疗前增大,差异均有统计学意义(P<0.05);观察组上述3项表面肌电信号潜伏期均短于对照组,波幅均高于对照组,差异均有统计学意义(P<0.05)。治疗后,2组患侧面动脉Vd、Vs指标值均较治疗前升高,RI指标值均较治疗前下降,差异均有统计学意义(P<0.05);观察组Vd、Vs指标值均高于对照组(P<0.05),RI指标值低于对照组(P<0.05)。治疗后,2组额肌、降口角肌、降下唇肌弹性模量值均较治疗前增加(P<0.05),观察组上述3项弹性模量值均高于对照组(P<0.05)。治疗后,2组H-B评分均较治疗前下降,FDIS评分均较治疗前升高,差异均有统计学意义(P<0.05);观察组H-B评分低于对照组,FDIS评分高于对照组,差异均有统计学意义(P<0.05)。结论:温针灸联合西药治疗风寒袭络型周围性面瘫可改善血液循环和面神经功能,恢复表情肌弹性,缓解临床症状。

一种针对Virtex-7加密位流的侧信道分析方法

随着FPGA在商业、国防等领域的广泛应用,出现了很多针对FPGA的攻击方法,电路安全性面临着极大挑战。为了进一步研究FPGA的安全机制,文章介绍了一种新的侧信道分析(SCA)方法,并首次在Xilinx Virtex-7芯片上分析了加密位流在加载过程中存在的安全漏洞。相比之前的攻击目标,Virtex-7芯片规模更大,采集的信号信噪比更低,攻击难度更大。之前的研究使用的是SASEBO或SAKURA这类专为SCA设计的测试板,而该文的分析是第一个在Xilinx官方评估板上进行的实例,由于官方评估板不是针对侧信道信号采集设计的电路板,因此需要经过处理才能获得足够的信噪比。使用电磁辐射作为侧信道测量值,在80万条电磁曲线内就能够获得一组密钥。通过密钥解密,得到明文位流,攻击者就能够对FPGA进行逆向分析、克隆等操作,从而影响FPGA的安全。

一种基于模板的RSA-CRT模约减攻击方法

目前针对RSA-CRT的建模类攻击研究较少,本文以模约减操作为研究对象,提出了一种针对RSA-CRT实现的模板攻击方法.该方法的核心是解决了如何由模约减后中间值的汉明重量恢复RSA-CRT私钥的难题.该方法的特点是基于模约减后中间值的汉明重量模型建模,通过采集选择密文模约减的能量迹进行模板匹配获取模约减后中间值的汉明重量,由汉明重量变化值恢复中间值,进一步恢复RSA-CRT算法的私钥.另外,该方法的优点在于理想情况下,基于中间值汉明重量模型建立的模板之间可以共用,且对中间值以多少位大小建模没有限制,可以选择字节大小,64位大小,甚至私钥p相同大小,实际环境中可根据泄露信息情况进行选取.最后,本文选择对中间值的最低字节进行建模,验证了该方法的可行性,并给出了防护建议.

处理器时间侧信道攻防技术综述

现代处理器优化机制众多,设计人员在追求性能提升时,往往忽略背后的安全风险。时间侧信道攻击因其影响面广且隐蔽性好已成为最主要的安全威胁之一。随着瞬态执行攻击的出现,时间侧信道攻击的能力被进一步扩展,计算系统的安全基础被动摇。为此,处理器厂商及安全人员提出了大量防御机制。这些机制具有不同的防护能力及性能开销。与此同时,新的瞬态执行漏洞和隐蔽信道也不断被发现,已提出的防御机制被不断突破。围绕处理器时间侧信道攻防技术的博弈日益激烈。本文从基本攻击原理出发,对现有时间侧信道攻击进行了归纳总结,并在此基础上进一步分析了相关防御机制的保护能力和性能瓶颈,从而梳理出时间侧信道攻防技术的发展趋势,为未来软硬件系统开发和安全技术探索提供参考。

针对ZUC算法硬件实现的相关能量攻击与多粒度时域敏感区域检测

本文通过合理分解模加操作,优化流水线结构,构建ZUC算法硬件实现,并基于FPGA开发板搭建ZUC算法功耗采集平台.构建粗细粒度时域敏感区域的泄漏检测方法,利用移动平均算子,发掘高信噪比风险区域,采用自相关滤波器与峰值检测算子,发掘具有明显重复特征的运算区间,并对泄漏高风险区域进行标定,实现高精度的泄漏风险定位.通过分析ZUC算法的脆弱性,本文提出一种基于选择初始向量IV的CPA攻击方案,对输入的IV信息进行选择,通过固定部分明文的方法有效提高采集信号的信噪比,并采集实际3000条功耗曲线,在算法初始化首轮,成功提取8 bit密钥信息,从而证明该方案的有效性,对ZUC算法的硬件实现进行侧信道防护是必要的.总结ZUC算法侧信道防护方案,对比方案优劣.

NOMA场景下基于双阶段训练的导频污染攻击检测和去污方案

导频污染攻击是攻击者使用与合法用户一致的导频去破坏合法用户的导频训练过程,是物理层中一种主动窃听手段。针对于目前基于调整导频结构的导频污染攻击研究在实际场景中的应用效果较差以及信道去污缺乏对角度域重叠概率探究的问题,提出可用于非正交多址接入环境的基于双阶段训练的导频污染攻击检测算法和基于空间特征的信道去污方案:首先利用接收信号在不同训练阶段正交投影结果的概率密度分布得到攻击检测结果;再利用信道能量在基站天线数较大时只会集中在少数几个方向上,并且不同用户信道在角度域上不可能存在重叠的理论依据实现信道去污。仿真实验表明,相较于基于随机矩阵理论的检测算法[10]和最小描述长度检测算法[11],提出的导频污染攻击检测方法在不同信噪比和导频长度下检测能力都得到显著改善;相较于基于特征值分解的盲信道估计算法[21]和线性最小均方误差信道估计算法[29],提出的信道去污方法在不同信噪比下去污性能上也得到了显著提升。

uBlock算法的低延迟一阶门限实现方法

目前已有文献给出了uBlock分组密码算法的侧信道防护方案,但是这些方案不仅延迟较高,难以适用于低延迟高吞吐场景,而且在毛刺探测模型下缺乏可证明安全性.针对这一问题,本文给出了在毛刺探测模型下具有可证明安全性的uBlock算法的低延迟门限实现方案.此外,我们引入了Changing of the Guards技术来避免防护方案在执行过程中需要额外随机数.对于防护方案的安全性,我们用自动化评估工具SILVER验证了S盒的毛刺探测安全性,并用泄露评估技术TVLA(Test Vector Leakage Assessment)验证了防护方案的整个电路的安全性.最后,我们用Design Compiler工具对防护方案的性能消耗情况进行了评估.评估结果显示,与序列化实现方式的uBlock防护方案相比,我们的防护方案的延迟能够减少约95%.