Side-channel power analysis of a GPU AES implementation

SummaryMany e‐business or social network servers have been constructed on cloud. On such open environments, private data of massive users have to be protected by encrypting, such as using Advanced Encryption Standard (AES), and furthermore, this process must be finished in a short time for users' better experience. This gives huge pressure on cloud servers, especially common servers, such as web servers. We urgently need an inexpensive and highly efficient method to relieve cloud servers' pressure. Fortunately, many cores of a graphics processing unit (GPU) can undertake this hard mission because of stronger computing power and lower price. The GPU environments can be virtualized on demand by cloud through the vCUDA technology. Of course, for those clouds not equipped with a GPU, a central processing unit (CPU) can still work as multithreads in parallel. Thus, in a cloud, AES can be parallelized using many cores of a GPU or multicores of a CPU with high efficiency and low cost. For typical cloud applications, such as web services, there are massive users and each one has short plaintext. If we simply parallelize AES in such an application, we cannot obtain better performance because of the GPU's extra data transferring cost. Thus, we coalesce the massive users' data and cut these data into same‐length slices for improving the performance of parallel AES as much as possible. So we design six parallel AES algorithms using GPU parallelism or CPU parallelism, which differ in parallel scope and whether data are coalesced or cut to slices. Specifically, they are coalescent and sliced GPU (GCS), coalescent and unsliced GPU, uncoalescent GPU, coalescent and sliced CPU, coalescent and unsliced CPU, and uncoalescent CPU. Moreover, we implement them on two representative platforms and evaluate their performance. Through comparing their performance, GCS has the best performance among these algorithms. In a cloud with Nvidia GPUs, GCS is a more powerful algorithm for massive users' data encrypting, relatively. Copyright © 2015 John Wiley & Sons, Ltd.

We evaluate the vulnerability of a pipelined Advanced Encryption Standard (AES) against Correlation Power Analysis (CPA) Side-Channel Attack (SCA). We identify that the registers in pipelined AES are most vulnerable against CPA SCA and propose a new power model targeting the switching activities of the registers. The proposed power model is constructed based on the Hamming Distance (HD) between the intermediate values stored in the registers in two consecutive clock cycles. Then, we analyze the vulnerability of pipelined AES under two scenarios. First, during regular pipeline operation where the device is performing AES pipeline operation. Second, in non-pipeline operation where we assume the adversaries can insert delay to the input of the device to increase the signal to noise ratio of the physical leakage information. The simulation results show that under regular pipelined operation, our proposed power model can reveal all the 16 key bytes in less than 4,900 traces, resulting in 4.7× more effective than the conventional power models. Under non-pipelined operation, our proposed power model requires only 590 traces to reveal all the 16 key bytes, which is 5.9× more effective than other power models.

Side-channel attacks (SCAs) using deep learning techniques have been mainly reported as profiled attacks, but in TCHES 2019, differential deep learning analysis (DDLA) was proposed by Timon as a non-profiled attack. In this attack method, deep learning models for all candidate keys are trained, and the key corresponding to the most suitable learning metrics such as loss and accuracy is assumed to be the correct key. Timon focused on a single bit (least significant bit (LSB) or most significant bit (MSB)) of the intermediate value during the operation of the cryptographic circuit and successfully revealed the correct key against the software implementation of the advanced encryption standard (AES). However, when we applied this method to our hardware implementation, we could not reveal all partial keys due to the existence of registers whose Hamming distance (HD) leakage is difficult to observe. In this paper, we propose a multi-bit DDLA that focuses on all bits to solve this problem. When a DDLA was performed on the hardware implemented AES without SCA countermeasures, the HD-ID labels, which had been used as a conventional profiled type DL-SCA method focusing on 8 bits, cannot reveal the 0, 4, 8, and 12th byte keys, but the proposed multi-bit method succeeds in revealing all key bytes. On the other hand, compared to correlated power analysis (CPA) which is a typical non-profiled attack that does not use deep learning, the number of waveforms required to reveal all keys is 1.6 times higher, so the DDLA with our proposed method is not so useful to the target without SCA countermeasures. Thus, we also evaluated the proposed method against FPGA-implemented RSM-AES and WDDL-AES, which have some resistance to SCA, and successfully revealed all keys against RSM and WDDL with 100,000 and 50,000 waveforms, respectively. This is a significant improvement over conventional CPA, which reveals less than half of the key bytes despite using twice as many waveforms as the proposed method. These results suggest that multi-bit DDLA is effective on non-profiled attacks against hardware-implemented AES circuit with SCA countermeasures.

The block cipher Rijndael has undergone more than ten years of extensive cryptanalysis since its submission as a candidate for the Advanced Encryption Standard (AES) in April 1998. To date, most of the publicly-known cryptanalytic results are based o

Graphics Processing Units (GPUs) are progressively used to expedite compute-intensive applications. Adversaries may use the data parallelism intrinsic to GPUs to extract sensitive information via timing, power, and cache assaults. This study introduces a Secure Shader Execution Framework that addresses these vulnerabilities via the integration of randomized execution, power balancing, and cache partitioning. The proposed vendor-agnostic method aligns with current GPU programming paradigms, as shown by the GPUOwl benchmarks using OpenCL. Experimental findings indicate that the framework successfully conceals side-channel information leakage in security-sensitive data with a minimal performance cost. Randomized execution lowers the success rate of timing assaults by as much as 75%, while power balancing decreases leakage in power traces by over 60%.

The present work concerns side-channel attacks on cryptographic devices protected with the advanced encryption standard. In this regard, the assessment of guessing entropy and the related uncertainty is proposed for machine learning-based attacks based on power measurements. For the first time, the guessing entropy was assessed on the entire key while uncertainty was introduced in the field of side-channel attacks, thus allowing a more rigorous vulnerability test for a device. Notably, a state-of-the-art attack relying on a multilayer perceptron is exploited for classifying power traces leaked from physically accessible devices. A public database was exploited for the sake of results reproducibility. Thanks to cross-validation, the uncertainty associated with retrieving a single key byte can be quantified and then propagated to the entire key by means of the Monte Carlo method. It is thus shown that, when exploiting about 4000 attack records (traces), there is a 10% probability to retrieve the secret key as a whole with less than ten attempts. This implies that a full cryptographic key can be discovered on average ten times for every 100 similar devices by a side-channel attack. This poses security threats particularly relevant in an internet-of-things scenario and addresses the need for improved vulnerability testing and proper countermeasures.

Graphics Processing Units (GPUs) are ubiquitous components used across the range of today’s computing platforms, from phones and tablets, through personal computers, to high-end server class platforms. With the increasing importance of graphics and video workloads, recent processors are shipped with GPU devices that are integrated on the same chip. Integrated GPUs share some resources with the CPU and as a result, there is a potential for microarchitectural attacks from the GPU to the CPU or vice versa. We consider the potential for covert channel attacks that arise either from shared microarchitectural components (such as caches) or through shared contention domains (e.g., shared buses). We illustrate these two types of channels by developing two reliable covert channel attacks. The first covert channel uses the shared LLC cache in Intel’s integrated GPU architectures. The second is a contention based channel targeting the ring bus connecting the CPU and GPU to the LLC. This is the first demonstrated microarchitectural attack crossing the component boundary (GPU to CPU or vice versa). Cross-component channels introduce a number of new challenges that we had to overcome since they occur across heterogeneous components that use different computation models and are interconnected using asymmetric memory hierarchies. We also exploit GPU parallelism to increase the bandwidth of the communication, even without relying on a common clock. The LLC based channel achieves a bandwidth of 120 kbps with a low error rate of 2%, while the contention based channel delivers up to 400 kbps with a 0.8% error rate. We also demonstrate a proof-of-concept prime-and-probe side channel attack that probes the full LLC from the GPU.

Purpose: Accurate and fast delineation of targets and normal structures based on daily CTs is critical for online adaptive radiotherapy (ART). Manual contouring generally takes too long to be practical. Auto-segmentation can run in a few minutes on modern computers, but it is desirable to reduce this time further. A simple, inexpensive option to accelerate auto-segmentation is to use a graphics processor unit (GPU). This work aims to evaluate the performance of a GPU-accelerated auto-segmentation. Method and Materials: A GPU card (NVidia GTX 285) was added to a computer consisting of two 3GHz four core CPUs running auto-segmentation software, ABAS (Atlas Based Auto Segmentation, Elekta CMS Software). To evaluate performance, this setup was tested using daily CTs acquired during IGRT using a CT-on-Rails (CTVision, Siemens) for 14 breast (4 prone, 10 supine) and 6 prostate cancer patients. Contours of targets and critical structures were populated from planning CTs to daily CTs using ABAS with and without the GPU. The accuracy of GPU-accelerated contouring was measured using Dice's Coefficient (DC). Results: For prostate cases, there is no noticeable difference between contours generated with and without GPU (<2% difference in DC to physician contours). The average time to segment was reduced by 30%, to 1.4 minutes, with GPU, (as low as 0.97 minutes). For prone breast cases, except for lumpectomy cavity (DC: 77 – 93%), there is also no substantial difference between contours with or without GPU (DC>95%). The average time to segment images was reduced by 33% with GPU (to 2.8 minutes). For supine breast cases, contours generated with and without GPU agreed equally with contours drawn by physicians. The GPU average segmentation time was 2.3 minutes, reduced by 47%. Conclusion: The use of GPU can substantially accelerate auto-segmentation without degrading the segmentation accuracy. This time saving is significant for online ART.

We propose a Multiplexer Look-Up-Table (MLUT) based Substitution-Box (S-Box) implementation for the Advanced Encryption Standard (AES) algorithm. There are two key features in the proposed MLUT based S-Box. First, it is implemented based on 256-byte to 1-byte multiplexer with a 256-byte memory instead of the conventional implementation of employing multiplication inversion in GF(28) and affine transformation. Thus, our proposed S-Box is simpler in circuit implementation and lower in power dissipation. Second, our S-Box is 30× more secured against the Side Channel Attack (SCA) based on Correlation Power Analysis (CPA), as our proposed S-Box exhibits smaller variance in its power dissipation profile for different processed data. Based on the measurement results of AES-128 implemented on the Sakura-X FPGA board, our proposed S-Box dissipates only 1.9mW and features 5.5× lower power than the conventional S-Box implementation. Our proposed MLUT S-Box design is also highly secured as the CPA attack on the AES with our proposed S-Box implementation requires 13540 power traces. This is significantly higher than the conventional S-Box which requires only 445 power traces to uncover the same secrete key.

Graphics processing units function well as high performance computing devices for scientific computing. The non-standard processor architecture and high memory bandwidth allow graphics processing units (GPUs) to provide some of the best performance in terms of FLOPS per dollar. Recently these capabilities became accessible for general purpose computations with the CUDA programming environment on NVIDIA GPUs and ATI Stream Computing environment on ATI GPUs. Many applications in computational science are constrained by memory access speeds and can be accelerated significantly by using GPUs as the compute engine. Using graphics processing units as a compute engine gives the personal desktop computer a processing capacity that competes with supercomputers. Graphics Processing Units represent an energy efficient architecture for high performance computing in flow simulations and many other fields. This document reviews the graphic processing unit and its features and limitations.

Network coding has recently been widely applied in various networks for system throughput improvement and/or resilience to network dynamics. However, the computational overhead introduced by the network coding operations is not negligible and has become the cornerstone for real deployment of network coding. In this paper, we exploit the computing power of contemporary Graphic Processing Units (GPUs) to accelerate the network coding operations. We proposed three parallel algorithms that maximize the parallelism of the encoding and decoding processes, i.e., the power of GPUs is fully utilized. This paper also shares our optimization design choices and our workarounds to the challenges encountered in working with GPUs. With our implementation of the algorithms, we are able to achieve up to 12 times of speedup over the highly optimized CPU counterpart, using the NVIDIA GPU and the Computer Unified Device Architecture (CUDA) programming model.

With the advancement of IoT edge devices, the threat to sensitive data processed at these devices is increasing. This research aims to enhance processor’s built-in resilience against power analysis attacks (PAA) by expanding pipeline stages, employing diverse pipeline techniques, and integrating additional features. The paper proposes 32-bit RISC-V core micro-architectures with inbuilt cryptographic capabilities, extending the RISC-V ISA with custom AES instructions to reduce energy consumption, code size, and encryption time compared to software AES solutions. An area-efficient 128-bit, 12-clock AES based on the Masoleh S-box is integrated into the RISC-V core, resulting in low area and power overheads. Two cores are presented: Core1, a 3-stage pipelined core with a software pause, and Core2, a 4-stage pipelined core with a hardware pause for securing data with AES instructions. Despite their vulnerabilities, the integration of AES with RISC-V architecture significantly improves their intrinsic resilience against PAA. This work analyses the vulnerability and improvement in intrinsic resilience of these cores to side-channel attacks, the impact of hardware versus software pause and the effect of pipeline stages on security metrics. The proposed designs are validated on a Xilinx Basys3 FPGA and developed in UMC 65 nm technology node. Power traces generated during AES encryption are extracted using Synopsys PrimeTime PX and analyzed with a MATLAB power attack model to successfully recover all key bytes. Core1 and Core2 achieved higher throughput of <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$2.02\times $ </tex-math></inline-formula> and <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$2.83\times $ </tex-math></inline-formula>, respectively, than the Arm CryptoCell312. Core2’s added circuits for hardware pause and increased number of pipeline stages significantly boost performance and enhance security against power attacks, with only a modest increase in area and power consumption.

As an improved method of lattice Boltzmann method (LBM), regularized lattice Boltzmann method (RLBM) has been applied to simulate fluid flow. Nevertheless, the performance of RLBM needs to be considered when simulating actual problems. The rise of multicore platforms, especially the popularity of graphics processor units (GPUs), has provided possible implementation solutions for parallel computing. In this article, an RLBM parallel model on the CPU/GPU heterogeneous platforms is proposed. To solve the problem of possible GPU memory shortage, the CPU controls the startup of the kernel function in the RLBM algorithm and participates in the calculation. Due to the characteristics of the algorithm, the entire flow field is divided into CPU computing areas and GPU computing areas according to the given flow field division rules. OpenMP and CUDA are, respectively, applied to CPU and GPU for parallel computing. The startup of the kernel function takes a short time, and the CPU and GPU can be approximately regarded as performing calculations simultaneously. Since the data exchange between the CPU and GPU has a significant impact on performance, a buffer is set at the boundary of the CPU and GPU to reduce the frequency of data exchange. The buffer size determines the number of program iterations before exchanging data. The performance of the algorithm is measured by MFLUPS, and the algorithm is applied to the 3D lid‐driven cavity flow. The obtained results show that the MFLUPS of the algorithm is 25 times that of CPU MFLUPS, and it adds an increment equivalent to CPU MFLUPS compared with GPU MFLUPS. And the algorithm is extended to a multi‐GPU version, which is also applied to the 3D lid‐driven cavity flow. The results obtained show that the MFLUPS of the multi‐GPU version is 1.8 times that of the single GPU.

The use of graphics processing units (GPUs) in simulation applications offers a significant speed gain as compared to computations on central processing units (CPUs). Many simulation methods require a large number of independent random variables generated at each step. We present two approaches for implementation of random number generators (RNGs) on a GPU. In the one-RNG-per-thread approach, one RNG produces a stream of random numbers in each thread of execution, whereas the one-RNG-for-all-threads method builds on the ability of different threads to communicate, thus, sharing random seeds across an entire GPU device. We used these approaches to implement Ran2, Hybrid Taus, and Lagged Fibonacci algorithms on a GPU. We profiled the performance of these generators in terms of the computational time, memory usage, and the speedup factor (CPU time/GPU time). These generators have been incorporated into the program for Langevin simulations of biomolecules fully implemented on the GPU. The ∼250-fold computational speedup on the GPU allowed us to carry out single-molecule dynamic force measurements in silico to explore the mechanical properties of the bacteriophage HK97 in the experimental subsecond time scale. We found that the nanomechanical response of HK97 depends on the conditions of force application, including the rate of change and geometry of the mechanical perturbation. Hence, using the GPU-based implementation of RNGs, presented here, in conjunction with Langevin simulations, makes it possible to directly compare the results of dynamic force measurements in vitro and in silico.

Side Channel Attacks are a popular modern cryptanalysis technique used by adversaries in embedded devices to break the security key. In these types of attacks, the attackers are keen on identifying the weaknesses of the physical implementation of the cryptosystem and utilize such vulnerabilities to extract the key. Power Analysis Attack is a form of Side Channel Attack in which, the adversary exploits power consumed by a cryptographic device during encryption to obtain the key. Mutual Information Analysis (MIA) is a concept introduced in information theory that measures the dependence between two random variables. In MIA based Power Analysis Attack, mutual information between two random variables is taken as the side channel distinguisher. Here, the two variables are physical leakages of the device and the power model based on key estimates. Since this method has more advantages to attackers compared to other methods, it is vital for cryptanalysts to find better countermeasures against this. But, due to the lack of efficient implementations it is hard for cryptanalysts to do that kind of research. In this paper, we present a methodology to accelerate MIA based Power Analysis Attacks using a GPU (Graphical Processor Unit) like NVIDIA Compute Unified Device Architecture (CUDA). Our proposed method promises to better utilize the capabilities of NVIDIA CUDA and obtain a speedup of more than 100 times compared to its sequential version.