Abstract:Embedded systems are prone to leak information via side-channels associated with their physical internal activity, such as power consumption, timing, and faults. Leaked information can be analyzed to extract sensitive data and devices should be assessed for such vulnerabilities. Side-channel power-supply leakage from embedded devices can also provide information regarding instruction-level activity for control code executed on these devices. Methods proposed to disassemble instruction-level activity via side-channel leakage have not addressed issues related to pipelined multi-clock-cycle architectures, nor have proven robustness or reliability. The problem of detecting malicious code modifications while not obstructing the sequence of instructions being executed needs to be addressed. In this article, instruction sequences being executed on a general-purpose pipelined computing platform are identified and instructions that make up these sequences are classified based on hardware utilization. Individual instruction classification results using a fine-grained classifier is also presented. A dynamic programming algorithm was applied to detect the boundaries of instructions in a sequence with a 100 percent accuracy. A unique aspect of this technique is the use of multiple power supply pin measurements to increase precision and accuracy. To demonstrate the robustness of this technique, power leakage data from ten target FPGAs programmed with a prototype of the pipelined architecture was analyzed and classification accuracies averaging 99 percent were achieved with instructions labeled based on hardware utilization. Individual instruction classification accuracies above 90 percent were achieved using a fine-grained classifier. Classification accuracies were also verified when a target FPGA was subjected to different controlled temperatures. The classification accuracies on discrete (ASIC) pipelined-architecture microcontrollers was 97 percent.

Formal Semantics Extraction from MIPS Instruction Manual

EXAMINER-PRO: Testing Arm Emulators Across Different Privileges

Flexible Instruction-Set Semantics via Abstract Monads (Experience Report)

Flexible Instruction-Set Semantics via Type Classes

Operationally Proving Memory Access Violations in Isabelle/HOL

Instruction Fusion Technology for the MIPS

Idev: Exploring and Exploiting Semantic Deviations in ARM Instruction Processing

Instruction Sequence Identification and Disassembly Using Power Supply Side-Channel Analysis

Automated Generation of Instruction Set Simulator from Specification

MIPE: a Practical Memory Integrity Protection Method in a Trusted Execution Environment.

Obfuscated Instructions for Software Protection

32-bit RISC CPU Based on MIPS Instruction Fetch Module Design

Synthesizing Hardware-Software Leakage Contracts for RISC-V Open-Source Processors

On a Consistency Testing Model and Strategy for Revealing RISC Processor's Dark Instructions and Vulnerabilities

Verification of Instruction Set Specification for an ASIP

On a Consistency Testing Model and Strategy for Revealing RISC Processor’s Dark Instructions and Vulnerabilities

Shesha: Multi-head Microarchitectural Leakage Discovery in new-generation Intel Processors

SemPat: Using Hyperproperty-based Semantic Analysis to Generate Microarchitectural Attack Patterns

Hardware-Assisted Monitoring For Instruction Security In Embedded System

Automatically Locating ARM Instructions Deviation between Real Devices and CPU Emulators

Program Generation for Functional Verification of Microprocessor