Towards Security Limits in Side-Channel Attacks

Inspired by the literature on side-channel attacks against cryptographic implementations, we describe a framework for the analysis of location privacy. It allows us to revisit (continuous) re-identification attacks with a combination of information theoretic and security metrics. Our results highlight conceptual differences between re-identification attacks exploiting leakages that are internal or external to a pseudonymised database. They put forward the amount of data to collect in order to estimate a predictive model as an important – yet less discussed – dimension of privacy assessments. They finally leverage recent results on the security evaluations/certification of cryptographic implementations to connect information theoretic and security metrics, and to formally bound the risk of re-identification with external leakages.

Latest nanometer CMOS technology nodes have highlighted new issues in security of cryptographic hardware implementations. The constant growth of the static power consumption has led to a new class of side-channel attacks. Common attacks exploiting static power use an univariate approach to recover information from cryptographic engines. In our work, a multivariate approach based on information theoretic security metrics is presented. The temperature-dependence helps to exploit more information leakage from the hardware implementation. Starting from a univariate analysis, mutual information reveals that increasing the working temperature, the information leaked through the static power side channel is increased as well. In this work a multivariate analysis exploiting static power consumption is presented in which the temperature-domain is used to extract more information. The use of information theoretic approach allows to precisely quantify the amount of information that can be leaked from a cryptographic hardware implementation. The perceived information shows taking advantage of the use of more than one temperature, the security level can be decreased. The improvement achieved using the presented approach is demonstrated on a 40 nm CMOS implementation of the Present 80 crypto core.

Understanding how the brain extracts the behavioral meaning carried by specific vocalization types that can be emitted by various vocalizers and in different conditions is a central question in auditory research. This semantic categorization is a fundamental process required for acoustic communication, and presupposes discriminative and invariance properties of the auditory system for conspecific vocalizations. Songbirds have been used extensively to study vocal learning, but the communicative function of all their vocalizations and their neural representation has yet to be examined. In this study, we first generated a library containing almost the entire zebra finch vocal repertoire, and organised communication calls along nine different categories according to their behavioral meaning. We then investigated the neural representations of these semantic categories in the primary and secondary auditory areas of six anesthetised zebra finches. To analyse how single units encode these call categories, we described neural responses in terms of their discrimination, selectivity and invariance properties. Quantitative measures for these neural properties were obtained with an optimal decoder using both spike counts and spike patterns. Information theoretic metrics show that almost half of the single units encode semantic information. Neurons achieve higher discrimination of these semantic categories by being more selective and more invariant. These results demonstrate that computations necessary for semantic categorization of meaningful vocalizations are already present in the auditory cortex, and emphasise the value of a neuro-ethological approach to understand vocal communication.

Navigation in mobile robotics involves two tasks, keeping track of the robot's position and moving according to a control strategy. In addition, when no prior knowledge of the environment is available, the problem is even more difficult, as the robot has to build a map of its surroundings as it moves. These three problems ought to be solved in conjunction since they depend on each other. <br/>This thesis is about simultaneously controlling an autonomous vehicle, estimating its location and building the map of the environment. The main objective is to analyse the problem from a control theoretical perspective based on the EKF-SLAM implementation. <br/>The contribution of this thesis is the analysis of system's properties such as observability, controllability and stability, which allow us to propose an appropriate navigation scheme that produces well-behaved estimators, controllers, and consequently, the system as a whole. <br/>We present a steady state analysis of the SLAM problem, identifying the conditions that lead to partial observability. It is shown that the effects of partial observability appear even in the ideal linear Gaussian case. This indicates that linearisation alone is not the only cause of SLAM inconsistency, and that observability must be achieved as a prerequisite to tackling the effects of linearisation. Additionally, full observability is also shown to be necessary during diagonalisation of the covariance matrix, an approach often used to reduce the computational complexity of the SLAM algorithm, and which leads to full controllability as we show in this work.<br/>Focusing specifically on the case of a system with a single monocular camera, we present an observability analysis using the nullspace basis of the stripped observability matrix. The aim is to get a better understanding of the well known intuitive behaviour of this type of systems, such as the need for triangulation to features from different positions in order to get accurate relative pose estimates between vehicle and camera. Through characterisation the unobservable directions in monocular SLAM, we are able to identify the vehicle motions required to maximise the number of observable states in the system. <br/>When closing the control loop of the SLAM system, both the feedback controller and the estimator are shown to be asymptotically stable. Furthermore, we show that the tracking error does not influence the estimation performance of a fully observable system and viceversa, that control is not affected by the estimation. Because of this, a higher level motion strategy is required in order to enhance estimation, specially needed while performing SLAM with a single camera. Considering a real-time application, we propose a control strategy to optimise both the localisation of the vehicle and the feature map by computing the most appropriate control actions or movements. The actions are chosen in order to maximise an information theoretic metric. Simulations and real-time experiments are performed to demonstrate the feasibility of the proposed control strategy.

A grammatical gender system divides a lexicon into a small number of relatively fixed grammatical categories. How similar are these gender systems across languages? To quantify the similarity, we define gender systems extensionally, thereby reducing the problem of comparisons between languages’ gender systems to cluster evaluation. We borrow a rich inventory of statistical tools for cluster evaluation from the field of community detection (Driver and Kroeber, 1932; Cattell, 1945), that enable us to craft novel information theoretic metrics for measuring similarity between gender systems. We first validate our metrics, then use them to measure gender system similarity in 20 languages. We then ask whether our gender system similarities alone are sufficient to reconstruct historical relationships between languages. Towards this end, we make phylogenetic predictions on the popular, but thorny, problem from historical linguistics of inducing a phylogenetic tree over extant Indo-European languages. Of particular interest, languages on the same branch of our phylogenetic tree are notably similar, whereas languages from separate branches are no more similar than chance.

Joint entropy analysis of anterior-posterior and medial-lateral body sway.

This technical report describes preliminary research investigating the relationship between information theory and Bayes' theory for estimation of the probability of clone overlap for the use in DNA restriction mapping. A number of languages (along with information theoretic metrics) capable of describing a hypothesized overlap are presented. For each language, the MML criterion is applied to the encoded overlaps of a pair of clones to search for that overlap which is most probable. The objective is to order the pair's encoded overlaps, based on the MML criterion, from the most to the least probable. This ordering is compared to the ordering suggestion by the Bayesian probabilistic approach.

Most wireless health monitoring devices are designed to continuously acquire, process, store and transmit photoplethysmogram (PPG) signal(s) that may undergo different kinds of waveform distortions at the processing stages of denoising, compression and transmission to be performed at the wireless biosensing node. Therefore, in this paper, we present and evaluate the performance of the information-theoretic metrics, including the mutual information (MI) and Kullback-Leibler divergence (KLD) by using various kinds of compression and reconstructed signals obtained based on the compressed sensing, discrete cosine transform, predictive coding, and discrete wavelet transform. Evaluation results on the 3-point and 2-point scale ratings of subjective quality evaluation test showed that the MI metric provides promising results in terms of higher Pearson correlation coefficient with subjective quality scores and prediction accuracy in correctly predicting the quality group as compared to that of the KLD metric.

In broadband fixed wireless access (BFWA) networks mainly operating above 20 GHz, a clear line-of-sight (LOS) path is necessary between the base stations (BS) and the subscribers (S). In this letter, a Markov-based method to estimate the packet loss rate (PLR) statistical characteristics over a dynamically, due to propagation, varying LOS BFWA channel is presented. The method is verified by means of information theoretic metrics and tested against simulation results.

Side-Channel Analysis (SCA) plays a crucial role in hardware security evaluation. However, side-channel acquisitions (a.k.a. traces) usually contain noises that often impose negative effects on key-recovery efficiency. In this paper, we propose convolutional denoising autoencoder (CDAE) for noise reduction in SCA. CDAE is composed of multiple layers of convolution operators, learning an end-to-end mapping from noisy traces to clean traces by minimizing the \(\ell _2\) loss of noisy-clean trace pairs. The convolutional layers capture the abstraction of the traces while eliminating noises. We argue that CDAE is very suitable for profiled SCA especially when the attacker has a large amount of traces in the offline profiling phase. Once the network training is done, our denoising network can be applied to individual new noisy traces for the attacker to launch online attacks. To validate the effectiveness of our method, we train CDAE to denoise traces and then perform Template Attacks (TA) in three high noise jamming scenarios, including unprotected (GPU and FPGA based) and protected (MCU based) AES implementations. Our method can significantly outperform the state-of-the-art Singular Spectrum Analysis (SSA) denoising method on both information theoretic metrics and security metrics. Results show that CDAE achieves at least \(\sim 4\times \) Signal-to-Noise Ratio (SNR) gain, thus TA with denoising preprocessing requires at most 50% of the traces in the attack phase.

Methods on modelling the human brain as a Complex System have increased remarkably in the literature as researchers seek to understand the underlying foundations behind cognition, behaviour, and perception. Computational methods, especially Graph Theory-based methods, have recently contributed significantly in understanding the wiring connectivity of the brain, modelling it as a set of nodes connected by edges. Therefore, the brain’s spatiotemporal dynamics can be holistically studied by considering a network, which consists of many neurons, represented by nodes. Various models have been proposed for modelling such neurons. A recently proposed method in training such networks, called full-Force, produces networks that perform tasks with fewer neurons and greater noise robustness than previous least-squares approaches (i.e. FORCE method). In this paper, the first direct applicability of a variant of the full-Force method to biologically-motivated Spiking RNNs (SRNNs) is demonstrated. The SRNN is a graph consisting of modules. Each module is modelled as a Small-World Network (SWN), which is a specific type of a biologically-plausible graph. So, the first direct applicability of a variant of the full-Force method to modular SWNs is demonstrated, evaluated through regression and information theoretic metrics. For the first time, the aforementioned method is applied to spiking neuron models and trained on various real-life Electroencephalography (EEG) signals. To the best of the authors’ knowledge, all the contributions of this paper are novel. Results show that trained SRNNs match EEG signals almost perfectly, while network dynamics can mimic the target dynamics. This demonstrates that the holistic setup of the network model and the neuron model which are both more biologically plausible than previous work, can be tuned into real biological signal dynamics.

Human mobility is a complex pattern of movements and activities that are based on some underlying semantics of human behavior. In order to construct accurate models of human mobility, this semantic behavior needs to be unearthed from the data sensed as a human being moves around and visits certain classes of locations such as home, work, mall, theater, restaurant etc. The ideal data for understanding the semantics of mobility would constitute timestamped mobility traces with detailed geographic locations with annotations about the type of each location. One way of achieving this is by following a hybrid strategy of participatory sensing (with each person carrying a wireless sensor device) and deploying static sensors at each location of interest – the contacts between the mobile and (annotated) static sensors can be logged at each location, and then collated to form an appropriate mobility traces. For example, a person can connect with his mobile phone over Bluetooth or WiFi to a local hotspot while checking into FourSquare at a restaurant. In the absence of static sensors, a person may manually annotate the places he visits on his device over time. However, most mobility traces consist of network connectivity data from cell phones (e.g., contact with towers) which lack detailed geographic locations and are ambiguous, noisy and unlabeled. Thus, it is important to extract the semantics of mobility that is latent in the available contact traces. To this end, we propose in this paper the concept of Probabilistic Latent Semantic Trajectories (PLST), an unsupervised approach to extract semantically different locations and sequential patterns of mobility from such traces. PLST extracts semantic locations as contextually co-occurring network elements (cell towers and Bluetooth devices) and models the behavior of their sequence. PLST extracts distinct locations with spatial, temporal and semantic coherency and can be used for accurate prediction of the next place a user visits. PLST also analyzes the complexity of mobility traces using information theoretic metrics to study the underlying structure and semantic content in mobility traces. This semantic content can be extracted allowing us to investigate mobility patterns in a completely unsupervised manner.

International audience

The RSA cryptographic algorithm is a security tool that has achieved long cryptographic and market maturity. However, after the discovery and wide spread of Side Channel Attacks (SCA), RSA implementations are susceptible to a variety of different attacks that target the hardware structure rather than the algorithm itself. While there are a wide range of countermeasures that can be applied on the RSA structure in order to protect the algorithm from specific SCA categories, combining several such measures to produce an "all in one" SCA resistant RSA structure is not an easy endeavor. Several incompatibility issues between combined SCA protection methods lead to new SCA vulnerabilities. In this paper, we evaluate some very popular and potent SCAs against RSA, like Fault attacks (FA), Simple Power attacks (SPA), Doubling attacks (DA) and Differential Power attacks (DPA), and propose an SCA protection scheme for RSA based on Chinese Remainder Theorem (CRT) that can thwart them. The proposed scheme uses a square and always multiply approach in combination with the message blinding technique in such a way that possible vulnerabilities that may rise from this combination can no longer apply. The proposed scheme is evaluated against specific SCAs and is found to be very secure. From performance point of view, the proposed scheme favors parallelism and can calculate an RSA result with small time delay.

This chapter extends the results obtained in Chapter 3 and Chapter 4 for discrete memoryless channels and sources to Gaussian channels and wireless channels, for which numerical applications provide insight beyond that of the general formula in Theorem 3.3. Gaussian channels are of particular importance, not only because the secrecy capacity admits a simple, intuitive, and easily computable expression but also because they provide a reasonable approximation of the physical layer encountered in many practical systems. The analysis of Gaussian channels also lays the foundations for the study of wireless channels. The application of physical-layer security paradigms to wireless channels is perhaps one of the most promising research directions in physical-layer security. While wireline systems offer some security, because the transmission medium is confined, wireless systems are intrinsically susceptible to eavesdropping since all transmissions are broadcast over the air and overheard by neighboring devices. Other users can be viewed as potential eavesdroppers if they are not the intended recipients of a message. However, as seen in earlier chapters, the randomness present at the physical layer can be harnessed to provide security, and randomness is a resource that abounds in a wireless medium. For instance, we show that fading can be exploited opportunistically to guarantee secrecy even if an eavesdropper obtains on average a higher signal-to-noise ratio than a legitimate receiver. We start this chapter with a detailed study of Gaussian channels and sources, including multiple-input multiple-output channels (Section 5.1.2).