Abstract:High-assurance embedded systems are deployed for decades and expensive to re-certify – hence, each new attack is an unpatchable problem that can only be detected by monitoring out-of-band channels such as the system’s power trace or electromagnetic emissions. Micro-Architectural attacks, for example, have recently come to prominence since they break all existing software-isolation based security – for example, by hammering memory rows to gain root privileges or by abusing speculative execution and shared hardware to leak secret data. This work is the first to use anomalies in an embedded system’s power trace to detect evasive micro-architectural attacks. To this end, we introduce power-mimicking micro-architectural attacks – including DRAM-rowhammer attacks, side/covert-channel and speculation-driven attacks – to study their evasiveness. We then quantify the operating range of the power-anomalies detector using the Odroid XU3 board – showing that rowhammer attacks cannot evade detection while covert channel and speculation-driven attacks can evade detection but are forced to operate at a 36 × and 7 × lower bandwidth . Our power-anomaly detector is efficient and can be embedded-of-band into (e.g.,) programmable batteries. While rowhammer, side-channel, and speculation-driven attack defenses require invasive code- and hardware-changes in general-purpose systems, we show that power-anomalies are a simple and effective defense for embedded systems. Power-anomalies can help future-proof embedded systems against vulnerabilities that are likely to emerge as new hardware like phase-change memories and accelerators become mainstream.

AN ANTI-DPA HARDWARE ARCHITECTURE OF EMBEDDED CPU BASED ON RANDOM DELAY

An AES Chip with DPA Resistance Using Hardware-Based Random Order Execution

Countering Power Analysis Attacks by Exploiting Characteristics of Multicore Processors

A Power Analysis Attack Countermeasure Based on Random Data Path Execution for CGRA.

A Hardware Implementation Of Des With Combined Countermeasure Against Dpa

Modeling Timing Randomization in Cryptographic Chip Against Power Analysis Attack

An Approach of Using Different Positions of Double Registers to Protect AES Hardware Structure from DPA

A Low Overhead DPA Countermeasure of ECC Based on Randomized Modular Multiplication

A Power Analysis Attack Resistant Multicore Platform with Effective Randomization Techniques

Side-Channel Information Leakage Analysis And Countermeasures In An Embedded Cpu Microarchitecture

Design and implementation of a Differential Power Analysis System for cryptographic devices

SecureD: A Secure Dual Core Embedded Processor

A Countermeasure For Power Analysis To Scalar Multiplication Of Ecc Hardware

Low-Latency PAE: Permutation-Based Address Encryption Hardware Engine for IoT Real-Time Memory Protection

Information Hiding for Aes Core Based on Randomness

Using Power-Anomalies to Counter Evasive Micro-Architectural Attacks in Embedded Systems

A Wavelet-based Power Analysis Attack Against Random Delay Countermeasure.

PARAM: A Microprocessor Hardened for Power Side-Channel Attack Resistance

Making Register File Resistant to Power Analysis Attacks.

A DPA-Resistant Digit-Parallel Modular Multiplier over GF (2m)

A combined countermeasure against DPA and implementation on DES