Photonic Side-Channel Analysis

As intended by its name, Physically Unclonable Functions PUFs are considered as an ultimate solution to deal with insecure storage, hardware counterfeiting, and many other security problems. However, many different successful attacks have already revealed vulnerabilities of certain digital intrinsic PUFs. Although settling-state-based PUFs, such as SRAM PUFs, can be physically cloned by semi-invasive and fully-invasive attacks, successful attacks on timing-based PUFs were so far limited to modeling attacks. Such modeling requires a large subset of challenge-response-pairs CRP to successfully model the targeted PUF. In order to provide a final security answer, this paper proves that all arbiter-based i.e. controlled and XOR-enhanced PUFs can be completely and linearly characterized by means of photonic emission analysis. Our experimental setup is capable of measuring every PUF-internal delay with a resolution of 6 picoseconds. Due to this resolution we indeed require only the theoretical minimum number of linear independent equations i.e. physical measurements to directly solve the underlying inhomogeneous linear system. Moreover, we neither require to know the actual PUF challenges nor the corresponding PUF responses for our physical delay extraction. On top of that devastating result, we are also able to further simplify our setup for easier physical measurement handling. We present our practical results for a real arbiter PUF implementation on a Complex Programmable Logic Device CPLD from Altera manufactured in a 180 nanometer process.

Reducing CO2 emissions from coal-fired power plants is an urgent global issue. Effective and precise monitoring of CO2 emissions is a prerequisite for optimizing electricity production processes and achieving such reductions. To obtain the high temporal resolution emissions status of power plants, a lot of research has been done. Currently, typical solutions are utilizing Continuous Emission Monitoring System (CEMS) to measure CO2 emissions. However, these methods are too expensive and complicated because they require the installation of a large number of devices and require periodic maintenance to obtain accurate measurements. According to this limitation, this paper attempts to provide a novel data-driven method using net power generation to achieve near-real-time monitoring. First, we study the key elements of CO2 emissions from coal-fired power plants (CFPPs) in depth and design a regression and physical variable model-based emission simulator. We then present Emission Estimation Network (EEN), a heterogeneous network-based deep learning model, to estimate CO2 emissions from CFPPs in near-real-time. We use artificial data generated by the simulator to train it and apply a few real-world datasets to complete the adaptation. The experimental results show that our proposal is a competitive approach that not only has accurate measurements but is also easy to implement.

Development of a high-resolution traffic emission model: Lessons and key insights from the case of Bogotá, Colombia

Study of material emission in ArF and KrF excimer laser ablation of yttria stabilized zirconia single crystals

Phenology of fine root and shoot using high frequency temporal resolution images in a temperate larch forest

The behavior of grain boundary sliding in pure and yttrium-doped Al2O3 was directly measured at a high temperature, using bicrystal experiments. For this purpose, we fabricated Al2O3 bicrystals containing a random grain boundary with or without yttrium ions. High-resolution transmission electron microscopy observations and energy dispersive x-ray spectroscopy analyses showed that bicrystals were successfully joined at an atomic scale, and doped yttrium ions segregated along the grain boundaries. It was found by compressive creep tests that the grain boundary sliding rate was restrained by two orders of magnitude due to yttrium addition, as compared to that of undoped bicrystals.

The 2010–2020 'megadrought' drives reduction in lake surface area in the Andes of central Chile (32º - 36ºS)

This work presents a novel low-cost optoelectronic setup for time- and spatially resolved analysis of photonic emissions and a corresponding methodology, Simple Photonic Emission Analysis (SPEA). Observing the backside of ICs, the system captures extremly weak photoemissions from switching transistors and relates them to program running in the chip. SPEA utilizes both spatial and temporal information about these emissions to perform side channel analysis of ICs. We successfully performed SPEA of a proof-of-concept AES implementation and were able to recover the full AES secret key by monitoring accesses to the S-Box. This attack directly exploits the side channel leakage of a single transistor and requires no additional data processing. The system costs and the necessary time for an attack are comparable to power analysis techniques. The presented approach significantly reduces the amount of effort required to perform attacks based on photonic emission analysis and allows AES key recovery in a relevant amount of time.

The statistical property of acoustic emission (AE) events from a plunged granular bed is analyzed by means of actual-time and natural-time analyses. These temporal analysis methods allow us to investigate the details of AE events that follow a power-law distribution. In the actual-time analysis, the calm-time distribution, and the decay of the event-occurrence density after the largest event (i.e., the Omori-Utsu law) are measured. Although the former always shows a power-law form, the latter does not always obey a power law. Markovianity of the event-occurrence process is also verified using a scaling law by assuming that both of them exhibit power laws. We find that the effective shear strain rate is a key parameter to classify the emergence rate of power-law nature and Markovianity in granular AE events. For the natural-time analysis, the existence of self-organized critical states is revealed by calculating the variance of natural time χ(k), where kth natural time of N events is defined as χ(k)=k/N. In addition, the energy difference distribution can be fitted by a q-Gaussian form, which is also consistent with the criticality of the system.

Optical side channel attack is a new kind of method against cipher chips, such as singlechips implementing public cryptographic algorithms. Two kind of optical side channel attacks, active and passive attacks, are presented in this paper. First, we implemented optical fault injection attacks against cipher algorithms running on AT89C52 singlechip, and demonstrated how to exploit secret information under attack. Then, we did photonic emission dependency analysis and revealed the correlation between operation/data and the photonic emission from the AT89C52 singlechip at the instruction level. Our experimental results show that optical side channel attacks pose serious threats to Cipher chips. KEYWORD: Optical side channel attack; Optical Fault Injection Attack; Photonic Emission Analysis; AES; Singlechip; AT89C52

This work systematically analyses the electrical and structural properties of a bilayer gate dielectric composed of Sm2O3 and ZrO2 on a 4H-SiC substrate. The bilayer thin film was fabricated using a sputtering process, followed by a dry oxidation step with an adjusted oxygen-to-nitrogen (O2:N2) gas concentration ratio. XRD analysis validated formation of an amorphous structure with a monoclinic phase for both Sm2O3 and ZrO2 dielectric thin films. High-resolution transmission emission (HRTEM) analysis verified the cross-section of fabricated stacking layers, confirmed physical oxide thickness around 12.08–13.35 nm, and validated the amorphous structure. Meanwhile, XPS confirmed the presence of more stoichiometric dielectric oxide formation for oxidized/nitrided O2:N2-incorporated samples, and more sub-stochiometric thin films for samples only oxidized in ambient O2. The oxidation/nitridation processes with N2 incorporation influenced the band offsets and revealed conduction band offsets (CBOs) ranging from 2.24 to 2.79 eV. The affected charge movement and influenced electrical performance where optimized samples with gas concentration ratio of 90% O2:10% N2 achieved the highest electrical breakdown field of 10.1 MV cm−1 at a leakage current density of 10−6 A cm−2. This gate stack also improved key parameters such as the effective dielectric constant (keff) up to 29.75, effective oxide charge (Qeff), average interface trap density (Dit), and slow trap density (STD). The bilayer gate stack of Sm2O3 and ZrO2 revealed potential attractive characteristics as a candidate for high-k gate dielectric applications in metal-oxide-semiconductor (MOS)-based devices.

Hard functional and logic failures which are insensitive to temperature, voltage, or frequency have become increasingly difficult to debug in advanced technology nodes, especially when Photon Emission (PEM) analysis could not provide any leads and Dynamic Laser Stimulation (DLS) could not be used due to the nature of the failure (no pass/fail margin). Laser Voltage Imaging (LVI), which is an extension of the Laser Voltage Probing (LVP) technique, provides a visual map of active components that are toggling at a certain frequency. This technique is widely employed in scan chain debug due to its simplicity, efficiency, and accuracy. However, most of LVI applications in literature reviews only involve scan chain fault isolation. This paper will present alternative applications for LVI, apart from scan chain debug. One specific application is the debug of a broken signal path by sending a periodic signal as a stimulus to a GPIO pad and tracing the LVI signal through the path by frequency mapping. In this paper, the concept and methodology behind this fault isolation approach will be discussed in full detail. Furthermore, three case studies of different types of hard failures with different applications of LVI will also be presented: an IO functional failure, an ATPG (Automatic test pattern generation) SAF (Stuck At Fault) failure and a BSDL(Boundary scan description language) input interconnect failure, to illustrate how LVI could be deployed in fault isolation for those functional and logic hard failures.

In this paper, we consider the problem of how to represent the locations of Internet hosts in a Cartesian coordinate system to facilitate estimation of network distances among arbitrary Internet hosts. We envision an infrastructure that consists of beacon nodes and provides the service of estimating network distance between pairs of hosts without direct delay measurement. We show that the principal component analysis (PCA) technique can effectively extract topological information from delay measurements between beacon hosts. Based on PCA, we devise a transformation method that projects the raw distance space into a new coordinate system of (much) smaller dimensions. The transformation retains as much topological information as possible and yet enables end hosts to determine their coordinates in the coordinate system. The resulting new coordinate system is termed as the Internet Coordinate System (ICS). As compared to existing work (e.g., IDMaps and GNP), ICS incurs smaller computation overhead in calculating the coordinates of hosts and smaller measurement overhead (required for end hosts to measure their distances to beacon hosts). Finally, we show via experiments with both real-life and synthetic data sets that ICS makes robust and accurate estimates of network distances, incurs little computational overhead, and its performance is not susceptible to the number of beacon nodes (as long as it exceeds a certain threshold) and the network topology.

Context. The INTEGRAL satellite has revealed a previously hidden population of absorbed high-mass X-ray binaries (HMXBs) hosting supergiant stars. Among them, IGR J16320–4751 is a classical system intrinsically obscured by its environment, with a column density of ∼1023 cm−2, more than an order of magnitude higher than the interstellar absorption along the line of sight. It is composed of a neutron star rotating with a spin period of ∼1300 s, accreting matter from the stellar wind of an O8I supergiant star, with an orbital period of ∼9 days. Aims. We investigated the geometrical and physical parameters of both components of the binary system IGR J16320–4751. Since in systems of this type the compact object is usually embedded in the dense and powerful wind of an OB supergiant companion, our main goal here was to study the dependence of the X-ray emission and column density along the full orbit of the neutron star around the supergiant star. Methods. We analyzed all existing archival XMM-Newton and Swift/BAT observations collected between 2003 and 2008, performing a detailed temporal and spectral analysis of the X-ray emission of the source. We then fitted the parameters derived in our study, using a simple model of a neutron star orbiting a supergiant star. Results. The XMM-Newton light curves of IGR J16320–4751 display high-variability and flaring activity in X-rays on several timescales, with a clear spin period modulation of ∼1300 s. In one observation we detected two short and bright flares where the flux increased by a factor of ∼10 for ∼300 s, with similar behavior in the soft and hard X-ray bands. By inspecting the 4500-day light curves of the full Swift/BAT data, we derived a refined period of 8.99 ± 0.01 days, consistent with previous results. The XMM-Newton spectra are characterized by a highly absorbed continuum and an Fe absorption edge at ∼7 keV. We fitted the continuum with a thermally comptonized COMPTT model, and the emission lines with three narrow Gaussian functions using two TBABS absorption components, to take into account both the interstellar medium and the intrinsic absorption of the system. For the whole set of observations we derived the column density at different orbital phases, showing that there is a clear modulation of the column density with the orbital phase. In addition, we also show that the flux of the Fe Kα line is correlated with the N H column, suggesting a clear link between absorbing and fluorescent matter that, together with the orbital modulation, points towards the stellar wind being the main contributor to both continuum absorption and Fe Kα line emission. Conclusions. Assuming a simple model for the supergiant stellar wind we were able to explain the orbital modulation of the absorption column density, Fe Kα emission and the high-energy Swift/BAT flux, allowing us to constrain the geometrical parameters of the binary system. Similar studies applied to the analysis of the spectral evolution of other sources will be useful to better constrain the physical and geometrical properties of the sgHMXB class.

The 4G-LTE network provides services for a large population, especially in densely populated areas. Because of this, it is very important to accurately assess the electromagnetic field levels from both 4G base stations (BSs) antennas and mobile phones (MPs), to check compliance with national and international guidelines. According to the present research view, exposure metrics is continuously challenged due to the time-varying nature of signals in mobile communications. Here, starting from the premise that regular time series could provide additional information about the nonlinear dynamics and chaotic representation of human exposure, a recurrence analysis was applied as a convenient method to describe the recurring emissions dynamics. For this aim, the power level recordings of BSs emissions were collected using an autonomous mobile network scanner and Qualipoc Android application in the 1800-MHz downlink band. Net differences of recurrent exposure profile emerged between BSs and MPs, with a high degree of determinism and predictability in the present investigated situation of BSs.