Empirical evaluation of multi-device profiling side-channel attacks

Side-channel analysis of cryptographic systems can allow for the recovery of secret information by an adversary even where the underlying algorithms have been shown to be provably secure. This is achieved by exploiting the unintentional leakages inherent in the underlying implementation of the algorithm in software or hardware. Within this field of research, a class of attacks known as profiling attacks, or more specifically as used here template attacks, have been shown to be extremely efficient at extracting secret keys. Template attacks assume a strong adversarial model, in that an attacker has an identical device with which to profile the power consumption of various operations. This can then be used to efficiently attack the target device. Inherent in this assumption is that the power consumption across the devices under test is somewhat similar. This central tenet of the attack is largely unexplored in the literature with the research community generally performing the profiling stage on the same device as being attacked. This is beneficial for evaluation or penetration testing as it is essentially the best case scenario for an attacker where the model built during the profiling stage matches exactly that of the target device, however it is not necessarily a reflection on how the attack will work in reality. In this work, a large scale evaluation of this assumption is performed, comparing the key recovery performance across 20 identical smart-cards when performing a profiling attack.

Received Signal Characteristics of the Indoor Off-Body Communications Channel at 5.8 GHz

In this paper we investigate the received signal characteristics of a mobile chest-worn transmitter at 5.8 GHz within a high multipath indoor environment. The off-body channel measurements considered both the co- and cross-polarized received signal for both line-of-sight (LOS) and non-LOS (NLOS) conditions. A straightforward channel model based upon the estimated path loss, a lognormal slow fading component and Ricean small-scale fading contribution is developed and used to perform simulations which allow the generation of first order received signal power characteristics.

Channel characterisation for indoor wearable active RFID at 868 MHz

Active radio-frequency identification systems that are used for the localisation and tracking of people will be subject to the same body centric processes that impact other forms of wearable communications. To achieve the goal of creating body worn tags with multiyear life spans, it will be necessary to gain an understanding of the channel conditions which are likely to impact the reader-tag interrogation process. In this paper we present the preliminary results of an indoor channel measurement campaign conducted at 868 MHz aimed at understanding and modelling signal characteristics for a wrist-worn tag. Using a model selection process based on the Akaike Information Criterion, the lognormal distribution was selected most often to describe the received signal amplitude. Parameter estimates are provided so that the channels investigated in this study may be readily simulated.

High Strength Thermoplastic Bonding for Multi-channel, Multi-layer Lab-on-Chip Devices for Ocean and Environmental applications

A solvent-vapour thermoplastic bonding process is reported which provides high strength bonding of PMMA over a large area for multi-channel and multi-layer microfluidic devices with shallow high resolution channel features. The bond process utilises a low temperature vacuum thermal fusion step with prior exposure of the substrate to chloroform (CHCl3) vapour to reduce bond temperature to below the PMMA glass transition temperature. Peak tensile and shear bond strengths greater than 3 MPa were achieved for a typical channel depth reduction of 25 µm. The device-equivalent bond performance was evaluated for multiple layers and high resolution channel features using double-side and single-side exposure of the bonding pieces. A single-sided exposure process was achieved which is suited to multi-layer bonding with channel alignment at the expense of greater depth loss and a reduction in peak bond strength. However, leak and burst tests demonstrate bond integrity up to at least 10 bar channel pressure over the full substrate area of 100 mm x 100 mm. The inclusion of metal tracks within the bond resulted in no loss of performance. The vertical wall integrity between channels was found to be compromised by solvent permeation for wall thicknesses of 100 µm which has implications for high resolution serpentine structures. Bond strength is reduced considerably for multi-layer patterned substrates where features on each layer are not aligned, despite the presence of an intermediate blank substrate. Overall a high performance bond process has been developed that has the potential to meet the stringent specifications for lab-on-chip deployment in harsh environmental conditions for applications such as deep ocean profiling.

An iterative longest matching segment approach to speech enhancement with additive noise and channel distortion

This paper presents a new approach to speech enhancement from single-channel measurements involving both noise and channel distortion (i.e., convolutional noise), and demonstrates its applications for robust speech recognition and for improving noisy speech quality. The approach is based on finding longest matching segments (LMS) from a corpus of clean, wideband speech. The approach adds three novel developments to our previous LMS research. First, we address the problem of channel distortion as well as additive noise. Second, we present an improved method for modeling noise for speech estimation. Third, we present an iterative algorithm which updates the noise and channel estimates of the corpus data model. In experiments using speech recognition as a test with the Aurora 4 database, the use of our enhancement approach as a preprocessor for feature extraction significantly improved the performance of a baseline recognition system. In another comparison against conventional enhancement algorithms, both the PESQ and the segmental SNR ratings of the LMS algorithm were superior to the other methods for noisy speech enhancement.

Speech Enhancement from Additive Noise and Channel Distortion - a Corpus-Based Approach

This paper presents a new approach to single-channel speech enhancement involving both noise and channel distortion (i.e., convolutional noise). The approach is based on finding longest matching segments (LMS) from a corpus of clean, wideband speech. The approach adds three novel developments to our previous LMS research. First, we address the problem of channel distortion as well as additive noise. Second, we present an improved method for modeling noise. Third, we present an iterative algorithm for improved speech estimates. In experiments using speech recognition as a test with the Aurora 4 database, the use of our enhancement approach as a preprocessor for feature extraction significantly improved the performance of a baseline recognition system. In another comparison against conventional enhancement algorithms, both the PESQ and the segmental SNR ratings of the LMS algorithm were superior to the other methods for noisy speech enhancement. Index Terms: corpus-based speech model, longest matching segment, speech enhancement, speech recognition

Storage of sediment-associated nutrients and contaminants in river channel and floodplain systems

Samples of fine-grained channel bed sediment and overbank floodplain deposits were collected along the main channels of the Rivers Aire (and its main tributary, the River Calder) and Swale, in Yorkshire, UK, in order to investigate downstream changes in the storage and deposition of heavy metals (Cr, Cu, Pb, Zn), total P and the sum of selected PCB congeners, and to estimate the total storage of these contaminants within the main channels and floodplains of these river systems. Downstream trends in the contaminant content of the <63 μm fraction of channel bed and floodplain sediment in the study rivers are controlled mainly by the location of the main sources of the contaminants, which varies between rivers. In the Rivers Aire and Calder, the contaminant content of the <63 μm fraction of channel bed and floodplain sediment generally increases in a downstream direction, reflecting the location of the main urban and industrialized areas in the middle and lower parts of the basin. In the River Swale, the concentrations of most of the contaminants examined are approximately constant along the length of the river, due to the relatively unpolluted nature of this river. However, the Pb and Zn content of fine channel bed sediment decreases downstream, due to the location of historic metal mines in the headwaters of this river, and the effect of downstream dilution with uncontaminated sediment. The magnitude and spatial variation of contaminant storage and deposition on channel beds and floodplains are also controlled by the amount of <63 μm sediment stored on the channel bed and deposited on the floodplain during overbank events. Consequently, contaminant deposition and storage are strongly influenced by the surface area of the floodplain and channel bed. Contaminant storage on the channel beds of the study rivers is, therefore, generally greatest in the middle and lower reaches of the rivers, since channel width increases downstream. Comparisons of the estimates of total storage of specific contaminants on the channel beds of the main channel systems of the study rivers with the annual contaminant flux at the catchment outlets indicate that channel storage represents <3% of the outlet flux and is, therefore, of limited importance in regulating that flux. Similar comparisons between the annual deposition flux of specific contaminants to the floodplains of the study rivers and the annual contaminant flux at the catchment outlet, emphasise the potential importance of floodplain deposition as a conveyance loss. In the case of the River Aire the floodplain deposition flux is equivalent to between ca. 2% (PCBs) and 36% (Pb) of the outlet flux. With the exception of PCBs, for which the value is ≅0, the equivalent values for the River Swale range between 18% (P) and 95% (Pb). The study emphasises that knowledge of the fine-grained sediment delivery system operating in a river basin is an essential prerequisite for understanding the transport and storage of sediment-associated contaminants in river systems and that conveyance losses associated with floodplain deposition exert an important control on downstream contaminant fluxes and the fate of such contaminants. © 2003 Elsevier Science Ltd. All rights reserved.

Can Leakage Models Be More Efficient? Non-Linear Models in Side Channel Attacks

In the last decade, many side channel attacks have been published in academic literature detailing how to efficiently extract secret keys by mounting various attacks, such as differential or correlation power analysis, on cryptosystems. Among the most efficient and widely utilized leakage models involved in these attacks are the Hamming weight and distance models which give a simple, yet effective, approximation of the power consumption for many real-world systems. These leakage models reflect the number of bits switching, which is assumed proportional to the power consumption. However, the actual power consumption changing in the circuits is unlikely to be directly of that form. We, therefore, propose a non-linear leakage model by mapping the existing leakage model via a transform function, by which the changing power consumption is depicted more precisely, hence the attack efficiency can be improved considerably. This has the advantage of utilising a non-linear power model while retaining the simplicity of the Hamming weight or distance models. A modified attack architecture is then suggested to yield the correct key efficiently in practice. Finally, an empirical comparison of the attack results is presented.

Flow Pattern in Compound Channel with Floodplain Double Groyne

The results of an experimental study and velocity analysis of the flow characteristics in the vicinityof a floodplain with two rows of permeable/impermeable groynes in compound channels with oneand two floodplains are presented. A 60% permeable groyne model with three different lengthsrelative to the floodplain width was used. The results showed that double groyne could beconsidered as one groyne (one block) for aspect ratio Sr < 2 (Sr = distance between twosuccessive groynes/groyne length). When Sr > 2, each groyne started to act independently.The velocity reduction was more than 45-52% of the floodplain’s approach velocity compared with30-35% in the case of a single groyne. The significant velocity reduction was located at a distance1.5-2 times the groyne length downstream of the single or the double groynes. Generally, themaximum velocities in the main channel ranged from 1.1 to 1.35 times the original approachingvelocity. The effective groyne relative length and aspect ratio should not to be more than 0.5 and 2,respectively.

Testing the channel-based model of duration perception

The channel-based model of duration perception postulates the existence of neural mechanisms that respond selectively to a narrow range of stimulus durations centred on their preferred duration (Heron et al Proceedings of the Royal Society B 279 690–698). In principle the channel-based model could
explain recent reports of adaptation-induced, visual duration compression effects (Johnston et al Current Biology 16 472–479; Curran and Benton Cognition 122 252–257); from this perspective duration compression is a consequence of the adapting stimuli being presented for a longer duration than the test stimuli. In the current experiment observers adapted to a sequence of moving random dot patterns at the same retinal position, each 340ms in duration and separated by a variable (500–1000ms) interval. Following adaptation observers judged the duration of a 600ms test stimulus at the same location. The test stimulus moved in the same, or opposite, direction as the adaptor. Contrary to the channel-based
model’s prediction, test stimulus duration appeared compressed, rather than expanded, when it moved in the same direction as the adaptor. That test stimulus duration was not distorted when moving in the opposite direction further suggests that visual timing mechanisms are influenced by additional neural processing associated with the stimulus being timed.

Sum-Rate and Power Scaling of Massive MIMO Systems with Channel Aging

This paper investigates the achievable sum-rate of massive multiple-input multiple-output (MIMO) systems in the presence of channel aging. For the uplink, by assuming that the base station (BS) deploys maximum ratio combining (MRC) or zero-forcing (ZF) receivers, we present tight closed-form lower bounds on the achievable sum-rate for both receivers with aged channel state information (CSI). In addition, the benefit of implementing channel prediction methods on the sum-rate is examined, and closed-form sum rate lower bounds are derived. Moreover, the impact of channel aging and channel prediction on the power scaling law is characterized. Extension to the downlink scenario and multi-cell scenario are also considered. It is found that, for a system with/without channel prediction, the transmit power of each user can be scaled down at most by 1= p M (where M is the number of BS antennas), which indicates that aged CSI does not degrade the power scaling law, and channel prediction does not enhance the power scaling law; instead, these phenomena affect the achievable sum-rate by degrading or enhancing the effective signal to interference and noise ratio, respectively.

An effective key generation system using improved channel reciprocity

In physical layer security systems there is a clear need to exploit the radio link characteristics to automatically generate an encryption key between two end points. The success of the key generation depends on the channel reciprocity, which is impacted by the non-simultaneous measurements and the white nature of the noise. In this paper, an OFDM subcarriers' channel responses based key generation system with enhanced channel reciprocity is proposed. By theoretically modelling the OFDM subcarriers' channel responses, the channel reciprocity is modelled and analyzed. A low pass filter is accordingly designed to improve the channel reciprocity by suppressing the noise. This feature is essential in low SNR environments in order to reduce the risk of the failure of the information reconciliation phase during key generation. The simulation results show that the low pass filter improves the channel reciprocity, decreases the key disagreement, and effectively increases the success of the key generation.

Cross-layer Framework for Fine-grained Channel Access in Next Generation High-density WiFi Networks

Densely deployed WiFi networks will play a crucial role in providing the capacity for next generation mobile internet. However, due to increasing interference, overlapped channels in WiFi networks and throughput efficiency degradation, densely deployed WiFi networks is not a guarantee to obtain higher throughput. An emergent challenge is how to efficiently utilize scarce spectrum resources, by matching physical layer resources to traffic demand. In this aspect, access control allocation strategies play a pivotal role but remain too coarse-grained. As a solution, this research proposes a flexible framework for fine-grained channel width adaptation and multi-channel access in WiFi networks. This approach, named SFCA (Sub-carrier Fine-grained Channel Access), adopts DOFDM (Discontinuous Orthogonal Frequency Division Multiplexing) at the PHY layer. It allocates the frequency resource with a sub-carrier granularity, which facilitates the channel width adaptation for multi-channel access and thus brings more flexibility and higher frequency efficiency. The MAC layer uses a frequency-time domain backoff scheme, which combines the popular time-domain BEB scheme with a frequency-domain backoff to decrease access collision, resulting in higher access probability for the contending nodes. SFCA is compared with FICA (an established access scheme) showing significant outperformance. Finally we present results for next generation 802.11ac WiFi networks.