Side-Channel Monitoring With Deterministic Noise Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing side-channel monitoring systems cannot differentiate between authorized and unauthorized monitoring devices, as masking emissions are indistinguishable from regular emissions, compromising device security.
Innovation Solution
Add deterministic noise to payload side-channel emissions, enabling authorized monitoring devices to filter out masking emissions and determine the operational state of the device while preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If masking emissions are added to side-channel emissions to prevent unauthorized monitoring, then device security is improved, but authorized monitoring capability deteriorates because masking emissions become indistinguishable from regular emissions
Solution Approach 1:
A shared secret acts as an intermediary between the device and authorized monitoring device. This shared secret enables the authorized monitor to generate identical masking emissions locally, allowing it to subtract and remove the masking component from received emissions. Unauthorized devices lacking the shared secret cannot perform this removal, thus maintaining security while enabling authorized monitoring.
Solution Approach 2:
The system changes the parameter of masking emissions from being purely random/unknown to being deterministic and reproducible through a shared secret. This allows the masking emissions to have a known structure that authorized monitors can identify and remove, while still appearing random to unauthorized observers.
2Reliability
If PUF-based masking emissions are used to create device-unique responses, then unauthorized information extraction is prevented, but the ability to monitor operational state deteriorates because PUF responses are indistinguishable from payload emissions
Solution Approach 1:
The shared secret serves as a mediator that allows authorized monitoring devices to reconstruct and remove PUF-based masking emissions. Without this intermediary, the PUF responses remain indistinguishable from payload emissions. With it, authorized monitors can precisely separate masking from payload emissions and accurately determine operational state.
Solution Approach 2:
The total side-channel emissions are segmented into two distinct components: masking emissions (generated by PUF) and payload emissions (from actual device operations). The shared secret enables authorized monitors to identify and separate these segments, allowing precise measurement of operational state while maintaining security through the masking component.
3Ease of operation
If deterministic noise is added to side-channel emissions, then authorized filtering becomes possible, but device complexity increases due to the additional noise generation mechanism
Solution Approach 1:
The shared secret mechanism serves multiple functions simultaneously: it generates masking emissions for security, enables authorized filtering capability, and provides a synchronization mechanism between device and authorized monitor. This multi-functionality reduces overall system complexity compared to implementing separate mechanisms for each function.
Solution Approach 2:
The device generates its own deterministic noise using the shared secret, and the authorized monitoring device generates identical noise independently using the same shared secret. This self-service approach eliminates the need for complex external noise generation or synchronization hardware, reducing system complexity while enabling authorized filtering.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Various embodiments disclosed herein provide for an authorized device monitoring system that can monitor the side-channel emissions of a device to determine the operational state of the device, while the device also masks the emissions to prevent unauthorized monitoring by third party devices. To accomplish this, deterministic noise is added to the regular payload side-channel emissions to create a combined side-channel emission that is received at an authorized monitoring device. The authorized monitoring device can then filter out the side-channel emissions that correspond to the deterministic noise in order to determine the operational state of the device under monitoring. The authorized monitoring device can be trained to both identify the deterministic noise, and trained to correlate the payload side-channel emissions after the deterministic noise removal, with various operational states of the device under monitoring.