Securing implementations of feedback-shift-register-based ciphers using compiler optimizations and co-processors

Los algoritmos basados en registros de desplazamiento con realimentación (en inglés FSR) se han utilizado como generadores de flujos pseudoaleatorios en aplicaciones con recursos limitados como los sistemas de apertura sin llave. Se considera canal primario a aquel que se utiliza para realizar una transmisión de información. La aparición de los ataques de canal auxiliar (en inglés SCA), que explotan información filtrada inintencionadamente a través de canales laterales como el consumo, las emisiones electromagnéticas o el tiempo empleado, supone una grave amenaza para estas aplicaciones, dado que los dispositivos son accesibles por un atacante. El objetivo de esta tesis es proporcionar un conjunto de protecciones que se puedan aplicar de forma automática y que utilicen recursos ya disponibles, evitando un incremento sustancial en los costes y alargando la vida útil de aplicaciones que puedan estar desplegadas. Explotamos el paralelismo existente en algoritmos FSR, ya que sólo hay 1 bit de diferencia entre estados de rondas consecutivas. Realizamos aportaciones en tres niveles: a nivel de sistema, utilizando un coprocesador reconfigurable, a través del compilador y a nivel de bit, aprovechando los recursos disponibles en el procesador. Proponemos un marco de trabajo que nos permite evaluar implementaciones de un algoritmo incluyendo los efectos introducidos por el compilador considerando que el atacante es experto. En el campo de los ataques, hemos propuesto un nuevo ataque diferencial que se adapta mejor a las condiciones de las implementaciones software de FSR, en las que el consumo entre rondas es muy similar. SORU2 es un co-procesador vectorial reconfigurable propuesto para reducir el consumo energético en aplicaciones con paralelismo y basadas en el uso de bucles. Proponemos el uso de SORU2, además, para ejecutar algoritmos basados en FSR de forma segura. Al ser reconfigurable, no supone un sobrecoste en recursos, ya que no está dedicado en exclusiva al algoritmo de cifrado. Proponemos una configuración que ejecuta múltiples algoritmos de cifrado similares de forma simultánea, con distintas implementaciones y claves. A partir de una implementación sin protecciones, que demostramos que es completamente vulnerable ante SCA, obtenemos una implementación segura a los ataques que hemos realizado. A nivel de compilador, proponemos un mecanismo para evaluar los efectos de las secuencias de optimización del compilador sobre una implementación. El número de posibles secuencias de optimizaciones de compilador es extremadamente alto. El marco de trabajo propuesto incluye un algoritmo para la selección de las secuencias de optimización a considerar. Debido a que las optimizaciones del compilador transforman las implementaciones, se pueden generar automáticamente implementaciones diferentes combinamos para incrementar la seguridad ante SCA. Proponemos 2 mecanismos de aplicación de estas contramedidas, que aumentan la seguridad de la implementación original sin poder considerarse seguras. Finalmente hemos propuesto la ejecución paralela a nivel de bit del algoritmo en un procesador. Utilizamos la forma algebraica normal del algoritmo, que automáticamente se paraleliza. La implementación sobre el algoritmo evaluado mejora en rendimiento y evita que se filtre información por una ejecución dependiente de datos. Sin embargo, es más vulnerable ante ataques diferenciales que la implementación original. Proponemos una modificación del algoritmo para obtener una implementación segura, descartando parcialmente ejecuciones del algoritmo, de forma aleatoria. Esta implementación no introduce una sobrecarga en rendimiento comparada con las implementaciones originales. En definitiva, hemos propuesto varios mecanismos originales a distintos niveles para introducir aleatoridad en implementaciones de algoritmos FSR sin incrementar sustancialmente los recursos necesarios. ABSTRACT Feedback Shift Registers (FSR) have been traditionally used to implement pseudorandom sequence generators. These generators are used in Stream ciphers in systems with tight resource constraints, such as Remote Keyless Entry. When communicating electronic devices, the primary channel is the one used to transmit the information. Side-Channel Attack (SCA) use additional information leaking from the actual implementation, including power consumption, electromagnetic emissions or timing information. Side-Channel Attacks (SCA) are a serious threat to FSR-based applications, as an attacker usually has physical access to the devices. The main objective of this Ph.D. thesis is to provide a set of countermeasures that can be applied automatically using the available resources, avoiding a significant cost overhead and extending the useful life of deployed systems. If possible, we propose to take advantage of the inherent parallelism of FSR-based algorithms, as the state of a FSR differs from previous values only in 1-bit. We have contributed in three different levels: architecture (using a reconfigurable co-processor), using compiler optimizations, and at bit level, making the most of the resources available at the processor. We have developed a framework to evaluate implementations of an algorithm including the effects introduced by the compiler. We consider the presence of an expert attacker with great knowledge on the application and the device. Regarding SCA, we have presented a new differential SCA that performs better than traditional SCA on software FSR-based algorithms, where the leaked values are similar between rounds. SORU2 is a reconfigurable vector co-processor. It has been developed to reduce energy consumption in loop-based applications with parallelism. In addition, we propose its use for secure implementations of FSR-based algorithms. The cost overhead is discarded as the co-processor is not exclusively dedicated to the encryption algorithm. We present a co-processor configuration that executes multiple simultaneous encryptions, using different implementations and keys. From a basic implementation, which is proved to be vulnerable to SCA, we obtain an implementation where the SCA applied were unsuccessful. At compiler level, we use the framework to evaluate the effect of sequences of compiler optimization passes on a software implementation. There are many optimization passes available. The optimization sequences are combinations of the available passes. The amount of sequences is extremely high. The framework includes an algorithm for the selection of interesting sequences that require detailed evaluation. As existing compiler optimizations transform the software implementation, using different optimization sequences we can automatically generate different implementations. We propose to randomly switch between the generated implementations to increase the resistance against SCA.We propose two countermeasures. The results show that, although they increase the resistance against SCA, the resulting implementations are not secure. At bit level, we propose to exploit bit level parallelism of FSR-based implementations using pseudo bitslice implementation in a wireless node processor. The bitslice implementation is automatically obtained from the Algebraic Normal Form of the algorithm. The results show a performance improvement, avoiding timing information leakage, but increasing the vulnerability against differential SCA.We provide a secure version of the algorithm by randomly discarding part of the data obtained. The overhead in performance is negligible when compared to the original implementations. To summarize, we have proposed a set of original countermeasures at different levels that introduce randomness in FSR-based algorithms avoiding a heavy overhead on the resources required.

Towards Closed-loop Deep Brain Stimulation: Behavior Recognition from Human STN

Deep brain stimulation (DBS) provides significant therapeutic benefit for movement disorders such as Parkinson’s disease (PD). Current DBS devices lack real-time feedback (thus are open loop) and stimulation parameters are adjusted during scheduled visits with a clinician. A closed-loop DBS system may reduce power consumption and side effects by adjusting stimulation parameters based on patient’s behavior. Thus behavior detection is a major step in designing such systems. Various physiological signals can be used to recognize the behaviors. Subthalamic Nucleus (STN) Local field Potential (LFP) is a great candidate signal for the neural feedback, because it can be recorded from the stimulation lead and does not require additional sensors. This thesis proposes novel detection and classification techniques for behavior recognition based on deep brain LFP. Behavior detection from such signals is the vital step in developing the next generation of closed-loop DBS devices. LFP recordings from 13 subjects are utilized in this study to design and evaluate our method. Recordings were performed during the surgery and the subjects were asked to perform various behavioral tasks. Various techniques are used understand how the behaviors modulate the STN. One method studies the time-frequency patterns in the STN LFP during the tasks. Another method measures the temporal inter-hemispheric connectivity of the STN as well as the connectivity between STN and Pre-frontal Cortex (PFC). Experimental results demonstrate that different behaviors create different m odulation patterns in STN and it’s connectivity. We use these patterns as features to classify behaviors. A method for single trial recognition of the patient’s current task is proposed. This method uses wavelet coefficients as features and support vector machine (SVM) as the classifier for recognition of a selection of behaviors: speech, motor, and random. The proposed method is 82.4% accurate for the binary classification and 73.2% for classifying three tasks. As the next step, a practical behavior detection method which asynchronously detects behaviors is proposed. This method does not use any priori knowledge of behavior onsets and is capable of asynchronously detect the finger movements of PD patients. Our study indicates that there is a motor-modulated inter-hemispheric connectivity between LFP signals recorded bilaterally from STN. We utilize a non-linear regression method to measure this inter-hemispheric connectivity and to detect the finger movements. Our experimental results using STN LFP recorded from eight patients with PD demonstrate this is a promising approach for behavior detection and developing novel closed-loop DBS systems.

Robust stability of sequential multi-input multi-output quantitative feedback theory designs

This paper re-examines the stability of multi-input multi-output (MIMO) control systems designed using sequential MIMO quantitative feedback theory (QFT). In order to establish the results, recursive design equations for the SISO equivalent plants employed in a sequential MIMO QFT design are established. The equations apply to sequential MIMO QFT designs in both the direct plant domain, which employs the elements of plant in the design, and the inverse plant domain, which employs the elements of the plant inverse in the design. Stability theorems that employ necessary and sufficient conditions for robust closed-loop internal stability are developed for sequential MIMO QFT designs in both domains. The theorems and design equations facilitate less conservative designs and improved design transparency.

Picosecond soliton transmission using concatenated nonlinear optical loop-mirror intensity filters

The issues involved in employing nonlinear optical loop mirrors (NOLMs) as intensity filters in picosecond soliton transmission were examined in detail. It was shown that inserting NOLMs into a periodically amplified transmission line allowed picosecond solitons to be transmitted under conditions considered infeasible until now. The loop mirrors gave dual function, removing low-power background dispersive waves through saturable absorption and applying a negative feedback mechanism to control the amplitude of the solitons. The stochastic characteristics of the pulses that were due to amplifier spontaneous-emission noise were investigated, and a number of new properties were determined. In addition, the mutual interaction between pulses was also significantly different from that observed for longer-duration solitons. The impact of Raman scattering in the computations was included and it was shown that soliton self-frequency shifts may be eliminated by appropriate bandwidth restrictions.

Travelling-wave model of semiconductor optical amplifier based non-linear loop mirror

A travelling-wave model of a semiconductor optical amplifier based non-linear loop mirror is developed to investigate the importance of travelling-wave effects and gain/phase dynamics in predicting device behaviour. A constant effective carrier recovery lifetime approximation is found to be reasonably accurate (±10%) within a wide range of control pulse energies. Based on this approximation, a heuristic model is developed for maximum computational efficiency. The models are applied to a particular configuration involving feedback.

Design and characterization of bridged loop-gap resonators for use in electron paramagnetic resonance measurements

This paper revisits the design of L and S band bridged loop-gap resonators (BLGRs) for electron paramagnetic resonance applications. A novel configuration is described and extensively characterized for resonance frequency and quality factor as a function of the geometrical parameters of the device. The obtained experimental results indicate higher values of the quality factor (Q) than previously reported in the literature, and the experimental analysis data should provide useful guidelines for BLGR design.

One-loop energy-momentum tensor in QED with electriclike background

We have obtained nonperturbative one-loop expressions for the mean-energy-momentum tensor and current density of Dirac's field on a constant electriclike back-round. One of the goals of this calculation is to give a consistent description of backreaction in such a theory. Two cases of initial states are considered: the vacuum state and the thermal equilibrium state. First, we perform calculations for the vacuum initial state. In the obtained expressions, we separate the contributions due to particle creation and vacuum polarization. The latter contribution,, are related to the Heisenberg-Euler Lagrangian. Then, we Study the case of the thermal initial state. Here, we separate the contributions due to particle creation, vacuum polarization, and the contributions due to the work of the external field on the particles at the initial state. All these contributions are studied in detail, in different regimes of weak and strong fields and low and high temperatures. The obtained results allow us to establish restrictions on the electric field and its duration under which QED with a strong constant electric field is consistent. Under such restrictions, one can neglect the backreaction of particles created by the electric field. Some of the obtained results generalize the calculations of Heisenberg-Euler for energy density to the case of arbitrary strong electric fields.

Theoretical and Experimental Study of Polarization Dependent Loss in a Optical Recirculating Loop

An experimental study of the Polarization Dependent Loss (PDL) is performed in an Optical Recirculating Loop (RCL). The RCL enables to simulate the transmission through various optical links using just one optical fiber spool, one in line amplifier, some optical filters and devices in a low cost manner. The total amount of PDL in a Recirculating loop, due to its statistical nature, is different of the simple sum of each element of the recirculating loop because of the alignment variation of the PDL elements with time, depending on the environmental conditions such as fiber stress and temperature. In this paper theoretical studies are also performed using formalism of Jones and Mueller matrices in order to represent the different optical elements in the recirculating loop. The PDL must be correctly characterized in order to evaluate properly the impact on the performance of next generation DWDM systems. Theoretical and experimental results comparison shows that a depolarization of 7% occurs in the experimental setup, probably by the optical amplifier due to the depolarized nature of the amplified spontaneous emission.

An approach of optimal sensitivity applied in the tertiary loop of the automatic generation control

This paper proposes an approach of optimal sensitivity applied in the tertiary loop of the automatic generation control. The approach is based on the theorem of non-linear perturbation. From an optimal operation point obtained by an optimal power flow a new optimal operation point is directly determined after a perturbation, i.e., without the necessity of an iterative process. This new optimal operation point satisfies the constraints of the problem for small perturbation in the loads. The participation factors and the voltage set point of the automatic voltage regulators (AVR) of the generators are determined by the technique of optimal sensitivity, considering the effects of the active power losses minimization and the network constraints. The participation factors and voltage set point of the generators are supplied directly to a computational program of dynamic simulation of the automatic generation control, named by power sensitivity mode. Test results are presented to show the good performance of this approach. (C) 2008 Elsevier B.V. All rights reserved.

Implementation of a Control Loop Experiment in a Network-Based Control System With LonWorks Technology and IP Networks

Considering the increasing popularity of network-based control systems and the huge adoption of IP networks (such as the Internet), this paper studies the influence of network quality of service (QoS) parameters over quality of control parameters. An example of a control loop is implemented using two LonWorks networks (CEA-709.1) interconnected by an emulated IP network, in which important QoS parameters such as delay and delay jitter can be completely controlled. Mathematical definitions are provided according to the literature, and the results of the network-based control loop experiment are presented and discussed.

Kinetics and Modeling of Fatty Alcohol Ethoxylation in an Industrial Spray Loop Reactor

The kinetics of the ethoxylation of fatty alcohols catalyzed by potassium hydroxide was studied to obtain the rate constants for modeling of the industrial process. Experimental data obtained in a lab-scale semibatch autoclave reactor were used to evaluate kinetic and equilibrium parameters. The kinetic model was employed to model the performance of an industrial-scale spray tower reactor for fatty alcohol ethoxylation. The reactor model considers that mass transfer and reaction occur independently in two distinct zones of the reactor. Good agreement between the model predictions and real data was found. These findings confirm the reliability of the kinetic and reactor model for simulating fatty alcohol ethoxylation processes under industrial conditions.

Valve friction and nonlinear process model closed-loop identification

Among several process variability sources, valve friction and inadequate controller tuning are supposed to be two of the most prevalent. Friction quantification methods can be applied to the development of model-based compensators or to diagnose valves that need repair, whereas accurate process models can be used in controller retuning. This paper extends existing methods that jointly estimate the friction and process parameters, so that a nonlinear structure is adopted to represent the process model. The developed estimation algorithm is tested with three different data sources: a simulated first order plus dead time process, a hybrid setup (composed of a real valve and a simulated pH neutralization process) and from three industrial datasets corresponding to real control loops. The results demonstrate that the friction is accurately quantified, as well as ""good"" process models are estimated in several situations. Furthermore, when a nonlinear process model is considered, the proposed extension presents significant advantages: (i) greater accuracy for friction quantification and (ii) reasonable estimates of the nonlinear steady-state characteristics of the process. (C) 2010 Elsevier Ltd. All rights reserved.

A Separation Principle for the Continuous-Time LQ-Problem With Markovian Jump Parameters

In this paper, we devise a separation principle for the finite horizon quadratic optimal control problem of continuous-time Markovian jump linear systems driven by a Wiener process and with partial observations. We assume that the output variable and the jump parameters are available to the controller. It is desired to design a dynamic Markovian jump controller such that the closed loop system minimizes the quadratic functional cost of the system over a finite horizon period of time. As in the case with no jumps, we show that an optimal controller can be obtained from two coupled Riccati differential equations, one associated to the optimal control problem when the state variable is available, and the other one associated to the optimal filtering problem. This is a separation principle for the finite horizon quadratic optimal control problem for continuous-time Markovian jump linear systems. For the case in which the matrices are all time-invariant we analyze the asymptotic behavior of the solution of the derived interconnected Riccati differential equations to the solution of the associated set of coupled algebraic Riccati equations as well as the mean square stabilizing property of this limiting solution. When there is only one mode of operation our results coincide with the traditional ones for the LQG control of continuous-time linear systems.

A Class of Channels Resulting in Ill-Convergence for CMA in Decision Feedback Equalizers

This paper analyzes the convergence of the constant modulus algorithm (CMA) in a decision feedback equalizer using only a feedback filter. Several works had already observed that the CMA presented a better performance than decision directed algorithm in the adaptation of the decision feedback equalizer, but theoretical analysis always showed to be difficult specially due to the analytical difficulties presented by the constant modulus criterion. In this paper, we surmount such obstacle by using a recent result concerning the CM analysis, first obtained in a linear finite impulse response context with the objective of comparing its solutions to the ones obtained through the Wiener criterion. The theoretical analysis presented here confirms the robustness of the CMA when applied to the adaptation of the decision feedback equalizer and also defines a class of channels for which the algorithm will suffer from ill-convergence when initialized at the origin.