Modulation and Side Channels Flashcards
Other classification of EM emissions
direct emanations and unintentionally modulated emanations
what are direct emanations and what are some properties associated with them?
- Result of direct current flows from within IC
- Observable over wide frequency band
- Higher frequencies are better because they have less noise
- Need to be close to the source
what are unintentionally modulated emanations?
they are the result of carrier signals produced by IC (ex clock signal)
AM
Amplitude modulation - change amplitude of signal to relay message (carrier + data signal)
FM
Angle/Phase Modulation - change in frequency of signal to relay message
Phase modulation
- Two carrier signals, same signal, just shifted by pi
- Embed a digital (0/1) signal - when we want to transmit a 0, use first carrier signal, use second signal for 1
how are pulse modulations different from continuous wave modulations?
PM use square pulse carrier, continuous use sinusoid
PAM
Pulse amplitude modulation - Amplitude of message is multiplied by the pulse signal
PWM
Pulse width modulation - Different width of the pulse represents different message signal
PPM
pulse position modulation - Amplitude and width remain the same, but modify the position of the pulse within the sampling period
square pulse signal examples
- Processor clock
- Memory clock
- Voltage regulator
- Power supply
- Memory refresh
what causes digital side channels?
square pulse signal is modulated with program activity
digital side channels have what types of modulations (incl example)
PWM - Difference instructions lasts different amounts of time per clock cycle
PAM - Different instructions consume different amounts of energy
analog vs digital
analog is continuous wave (sinusoid), digital is clock
screaming side channels. what are they? how are they created?
digital signal gets modulated onto an analog signal via connection through ground or voltage supply plane
SAVAT
Signal Available to Attacker - qualifies instruction-level differences available to the attacker
How does SAVAT compare instructions?
Measure (A/B) and compare the two by integrating over the peak to get total power and then divide by number of (A/B) instances => get the energy/instruction
What is an advantage of SAVAT?
Can measure at any frequency
What are the loudest / weakest instructions according to SAVAT?
loudest = load/store to memory, divide weakest = add/sub
What are the loudest / weakest instructions according to SAVAT?
loudest = load/store to memory, divide weakest = add/sub
How to use SC to get information about loops?
Each iteration of a loop will have its own signal/frequency, which will repeat over time
Describe the frequency domain representation of a modulated signal (AM)
- Middle peak for carrier signal
- Peaks on either side for message signal (carrier freq +- alternation freq)
Steps for spectrum profiling
train with instrumentation
train without instrumentation
profile spectrogram
cons of instrumentation
- Changes behavior of program
- Limited support
- Might need to analyze already-deployed devices
what is spectrum profiling?
Spectral profile measures the loops in the program by monitoring EM emanations in frequency
how to eliminate noise in spectrogram
by running spectrogram before/after program is run to find the noise