DPA Countermeasures

In the late 19th century, Dutch cryptographer Auguste Kerckhoff postulated what has become known as “Kerckhoff’s Principle” — a cryptosystem should be secure even if everything about the system, except the key, is public knowledge.

Since Kerckhoff’s days, cryptography has certainly evolved. A modern interpretation of Kerckhoff teaches that you shouldn’t rely on the obscurity of your crypto algorithm, but rely instead on standard algorithms with strong key sizes. A natural assumption might be that standard algorithms would be able to conceal themselves, making it difficult to determine the algorithm in use. This actually isn’t the case – and isn’t even necessary for a security sub-system to resist attacks. Suppose you’re using a NIST-standard algorithm in your device — how is anyone ever going to know? Can an adversary tell what algorithm you’re using? It turns out they can – but that’s ok.

Using inexpensive tools, electromagnetic and/or power data from a semiconductor can be captured. That data can used to determine what cryptographic algorithm is being deployed; experienced analysts are often able to readily identify the algorithm deployed simply by looking at a series of waveforms. For instance, a waveform with 10 distinct rounds may indicate a 128-bit AES encryption standard (shown in Figure 1), whereas a 14 round waveform may indicate a 256-bit AES. Other popular cryptographic algorithms like RSA (shown in Figure 2), SHA, and Elliptic Curve all have a distinct “signatures” which may inform the analyses (i.e. the adversary) what algorithm is being executed, the key size, and where it’s happening in the overall computational process.

So why Is knowledge of the algorithm deployed not a concern? This is the heart of Kerckhoff’s teachings. All NIST-standard algorithms derive security from the secrecy of the key and the cryptographic strength of the algorithm, but not the secrecy of the algorithm. And that secret key value is completely independent of the algorithm deployed – while the algorithm requires a certain size of key (e.g., AES-256 requires a 256-bit key value), the value of the key can be random set of digits. A 128-bit key has 2¹²⁸ possible key combinations: that’s 340,282,366,920,938,463,463,374,607,431,768,211,456 combinations, which is 39 digits long – not something easily guessed! Without knowing the secret key value, adversaries have no way to penetrate the security of the chip, even if they have perfect knowledge of the algorithms deployed within the chip. The attack vector thus shifts to extracting the key, not what cryptographic algorithm(s) the device is running.

There are a multitude of attack vectors that adversaries use to extract the secret key which are known as Side-Channel Attacks, which include Differential Power Analysis (DPA), Simple Power Analysis (SPA), Simple Electromagnetic Analysis (SEMA), Differential Electromagnetic Analysis (DEMA), Correlation Power Analysis (CPA) and Correlation Electromagnetic Analysis (CEMA). Side-channel attacks work on the reality that all physical electronic systems routinely leak information about the internal process of computing via fluctuating levels of power consumption and electromagnetic emissions. Rather than using brute force attacks, side-channel attacks exploit those leaks by repeatedly capturing and analyzing samples. Rambus’s Differential Power Analysis Workstation is a powerful tool in understanding a device’s resistance to attack.

Perhaps most concerning about side-channel attacks is that while they formerly may have taken a prohibitively expensive level of equipment and expertise, today these attacks can be executed relatively cheaply and easily using off-the-shelf equipment. To combat side-channel attacks, Rambus offers a series of side-channel resistant cryptographic algorithms. Through various techniques, including leakage reduction, noise introduction, obfuscation, and the incorporation of randomness, the protected algorithms are effective at resisting side-channel attacks up to and beyond 1 billion operations, securing our customers’ devices against attack.

Within the industry, we say that “security by obscurity” is a bad idea. While we don’t necessarily recommend publishing your security architecture on the front page of the New York Times, we believe that your architecture should be able to withstand attacks based on that amount of disclosure. Corporate espionage, accidents, vandalism, or even reverse engineering can reveal the design of security.  Accepted security best practices don’t involve hiding what security you are deploying, but rather spending your time and efforts on making sure your security is deployed in such a manner that when your security architecture is determined (and it will be!), it is as resistant to as many attacks as possible, just as Kerckhoff spoke of almost 150 years ago.

Written by Paul Karazuba for Rambus Press

A team of North Carolina State University researchers recently published a paper that highlights the vulnerability of machine learning (ML) models to side-channel attacks. Specifically, the team used power-based side-channel attacks to extract the secret weights of a Binarized Neural Network (BNN) in a highly-parallelized hardware implementation.

“Physical side-channel leaks in neural networks call for a new line of side-channel analysis research because it opens up a new avenue of designing countermeasures tailored for deep learning inference engines,” the researchers wrote. “On a SAKURA-X FPGA board, [our] experiments show that the first-order DPA attacks on [an] unprotected implementation can succeed with only 200 traces.”

According to Jeremy Hsu of IEE Spectrum, machine learning algorithms that enable smart home devices and smart cars to automatically recognize various types of images or sounds such as words or music are among the artificial intelligence (AI) systems “most vulnerable” to such attacks.

“Such algorithms consist of neural networks designed to run on specialized computer chips embedded directly within smart devices, instead of inside a cloud computing server located in a data center miles away,” he explains. “This physical proximity enables such neural networks to quickly perform computations with minimal delay, but also makes it easy for hackers to reverse-engineer the chip’s inner workings using a method known as differential power analysis (DPA).”

Indeed, edge devices storing AI/ML models and data can be physically disassembled. If unprotected, an attacker can run malicious firmware, intercept network traffic, and employ various side-channel techniques to extract secret keys and steal sensitive information. Both AI/ML inference models, as well as input data and results, are often quite lucrative and should be shielded from criminal elements intent on financial gain. Moreover, the integrity of AI/ML systems must be secured from tampering to prevent malicious attackers from designing cloned or competitive devices, as well as altering training models, input data, and results.

To protect both silicon and data, edge devices running AI/ML algorithms should be built on top of a secure, tamper-proof foundation that ensures confidentiality, integrity, authentication, and availability (up-time). This can be achieved with a programmable security co-processor such as the Rambus CryptoManager Root of Trust (CMRT) which uses a combination of hardware and software countermeasures to thwart side-channel attacks. For AI/ML edge devices built without the Rambus CMRT, we recommend that system designers utilize a Test Vector Leakage Assessment (TVLA) platform like Rambus’ DPA Workstation Analysis Platform (DPAWS) to help detect side-channel leakage and implement appropriate countermeasures.

DPAWS includes all the hardware, software, and training material needed to evaluate and certify secure AI/ML edge devices. It offers a Windows-based, intuitive user interface that enables system designers to efficiently perform side-channel analysis on AI/ML edge devices to identify potential security flaws. Collected signals are examined using simple power and electromagnetic analysis (SPA/SEMA) or more powerful differential power and electromagnetic analysis (DPA/DEMA) to identify exposure of secret keys.

The recently released DPAWS 9.2 offers several new notable features, including sample leakage history plotting. This capability allows system designers to detect and better understand side-channel leakage. More specifically, confirming the increase of electronic leakage across time can help improve countermeasure design, detect additional locations vulnerable to potential leakage, and provide a baseline for comparing non-leaking locations.

DPAWS 9.2 also offers system designers access to bi-variate leakage detection; a form of higher-order side-channel analysis to which more robust designs may need to be resistant. Essentially, bi-variate analysis combines different points from within the analysis range to detect leakage. This methodology may reveal leaks in implementations that are univariate or first-order secure. Previously, separate tools were used to combine pairs of data points within the analysis window or perform bivariate analysis from the command line.

In summary, AI/ML edge devices, like all physical electronic systems, routinely leak information about the internal process of computing via fluctuating levels of power consumption and electro-magnetic emissions. To protect both silicon and data, edge devices running AI/ML algorithms should be built on top of a secure, tamper-proof foundation. As well, AI/ML edge devices should be carefully evaluated with a testing platform like Rambus DPAWS to validate the effectiveness of countermeasures in reducing sensitive side-channel leakage.

All physical electronic systems routinely leak information about the internal process of computing via fluctuating levels of power consumption and electro-magnetic emissions. Much like traditional safecracking, an electronic side-channel attack (SCA) eschews a brute force approach to extracting keys and other secret information from a device or system. As such, an SCA conducted against electronic devices and systems are non-intrusive, relatively simple and inexpensive to execute. SCAs comprise a wide range of techniques including Differential Power Analysis (DPA), Simple Power Analysis (SPA), Simple Electromagnetic Analysis, Differential Electromagnetic Analysis, Correlation Power Analysis and Correlation Electromagnetic Analysis.

Attacking deep neural networks

Recently, a team of white hat researchers created a side-channel technique specifically designed to reveal the internal structure and parameters of deep neural network (DNN) computer vision models. As the researchers note in a paper published on arXiv, studies indicate that DNNs are vulnerable to adversarial attacks, which can be either white-box or black-box.

“During the computation process of the DNNs, the side-channel information shows strong correlations to the network structure and its parameters,” the researchers explain. “We envision that SCA can be used for embedded AI devices and reveal their network architectures and even the corresponding parameters. In other words, we intend to use SCA to open the black-box of DNNs, which can facilitate adversarial attacks by transforming a black-box attack to an at least partial white-box, or gray-box, attack.”

Image Credit: Yun Xiang, Zhuangzhi Chen, Zuohui Chen, Zebin Fang, Haiyang Hao, Jinyin Chen, Yi Liu, Member, IEEE, Zhefu Wu, Qi Xuan, Member, IEEE and Xiaoniu Yang (via arXiv)

To execute their SCA against a DNN, the researchers designed a Raspberry-Pi based platform to derive the power signature of embedded AI devices. The team then utilized machine learning algorithms to identify specific DNN architectures. As the researchers note, the Raspberry Pi is an ARM cortex-based system that shares the common architecture of many existing devices. As such, the experiments performed on the Pi can be easily applied to similar systems.

“One critical observation is that different components [convolutional layers, pooling layers, fully connected layers and activation function] require different computational cost,” the researchers state. “Therefore, different architectures have different power consumption patterns, which makes DNN architectures vulnerable to SCAs. In general, our technique can identify both the architecture and model parameters with quite high accuracy, indicating that we should pay strong attention to the security problem of many AI applications.”

In the future, the white hat security team plans to improve its experimental platform by analyzing additional DNN architectures and parameters with advanced machine learning algorithms that more precisely identify DNN models.

SCA resistance and countermeasures

To protect the internal structure and parameters of deep neural networks (DNNs), we recommend implementing an effective layer of side-channel countermeasures via hardware (DPA resistant cores), software (DPA resistant software libraries) or both. Countermeasures – including leakage reduction, noise introduction, obfuscation and the incorporation of randomness – are critical to ensuring the protection of sensitive keys and data. It should be noted that stand-alone noise introduction is incapable of sufficiently masking side-channel emissions. Indeed, DPA conducted against a device can effectively bypass stand-alone noise countermeasures, ultimately allowing the signal to be isolated.

After layered countermeasures have been implemented, systems should be carefully evaluated with a Test Vector Leakage Assessment (TVLA) platform such as the Rambus DPA Workstation (DPAWS) to confirm the cessation of sensitive side-channel leakage. More specifically, DPAWS measures a range of side-channel attacks across a wide spectrum of devices and platforms. DPAWS also provides users with a highly intuitive UI paired with enhanced data visualization that creates an integrated, project-centric analytic environment specifically designed to optimize the efficiency of side-channel analysis.

Both flexible and scalable, DPAWS supports multiple side-channel sensors, device protocols and form factors, with out-of-the-box support for SASEBO and additional third-party hardware. DPAWS also easily integrates with a wide range of industry tools including Matlab, Python and other scripting languages. Moreover, the Rambus DPA Workstation supports full cipher coverage (AES, RSA, ECC, DES and SHA), large dataset handling, as well as high-speed collection and analysis of billions of traces. Source code is also available to facilitate increased flexibility.

Interested in learning more about protecting systems from side-channel attacks?

>> Download our eBook <<