EM-X-DL: Efficient Cross-Device Deep Learning Side-Channel Attack with Noisy EM Signatures

The main limitation of ML models for profiling SCA attacks is their portability to other target devices. Specifically, these models have been shown to work when the same device is used for both profiling and testing, however, in a real attack, the attacker would use a device to profile, then attack a separate, identical device. This issue of portability has recently been addressed for power ML SCA models on AES-128 in (Das et al., 2019), (Bhasin et al., 2019), and also with a 3-class DNN attacking RSA implementations for EM SCA (Carbone et al., 2019). However, these works only consider high SNR scenarios, and with the introduction of SNR reducing countermeasures (Das et al., 2019) or low cost, low sensitivity EM probes, practical attacks must address the reality of low SNR trace measurements. In this work, we show a deep-learning based cross-device SCA attack with low-SNR EM signatures.

A 256-class DNN model that can be trained successfully ($>99\%$ validation accuracy) (Das et al., 2019) using raw time-domain AES-128 power traces for a particular microcontroller is rendered futile for low SNR EM SCA training even with traces collected from the same device (Figure 1(a)). Figure 1(b) shows the variance of a point of interest (POI, determined using the difference of means approach (Chari et al., 2003; Choudary and Kuhn, 2018)) across 10K EM and power traces. It clearly shows that the variation in the EM traces is much higher than the power traces, implying significantly lower SNR for the EM signatures. Indeed, when considering the side-channel SNR as defined in (Mangard, [n. d.]) as $\textbf{SNR}=\frac{VAR[Q]}{VAR[N]}$, with $Q$ being the side-channel leakage and $N$ being the noise, there is a large difference when comparing power and EM measurements. The side-channel SNR across a random selection of 7 devices for power traces is 19.6 dB, while the SNR of equivalent EM traces is 3.1 dB, as is seen in Figure 2. Note that the SNR of a single device is comparable for both power and EM, but adding additional devices lowers the SNR drastically, due to the device-to-device variations. In fact, a majority of the lower SNR in the EM realm is due to inter-device variations being more prominent in EM compared to power, again looking at Figure 2. So, to solve the problem of portability, we need to take into account the inter-device variations (Renauld et al., 2011). To resolve all these issues, we utilize averaging to enhance the SNR, analyze different pre-processing techniques to reduce the dimensionality of the data, and develop an intelligent algorithm to choose the set of training devices for efficient profiling, given the need for more training devices to train a model due to the larger effect of inter-device variations. Finally, we also propose an end-to-end EM-X-DL attack framework to perform EM scanning and find the best point of leakage on an unseen target device. A combination of these techniques allows us to achieve $>90\%$ cross-device accuracy.

The specific contributions of this work are:

• •

  This work presents a cross-device deep-learning based EM SCA (EM-X-DL) on an AES-128 encryption engine using a 256-class DNN in a low SNR scenario, with ten devices for training and tested on a different set of ten test devices (Sec. 3).

• •

  Effect of different pre-processing techniques including principal component analysis (PCA), linear discriminant analysis (LDA), fast fourier transform (FFT), spectrogram, on handling the portability issue is analyzed and compared, showing that the LDA is the most efficient approach to achieve maximum average cross-device key prediction accuracy of $\sim 91.5\%$ with minimum training time (Sec. 3.3).

• •

  An algorithm for the optimal selection of the training devices is proposed, so that the number of training devices and thus the overall training time is minimized (Sec. 4, Algo. 1).

Since the inception of power SCA  (Kocher et al., 1999), a wide variety of attacks have been demonstrated, which can be broadly classified into non-profiled attacks like differential/correlational power/EM analysis (DPA, CPA, DEMA, CEMA)  (Brier et al., 2004),  (Kocher et al., 1999), and profiled attacks, such as the statistical template attacks (Chari et al., 2003) and ML SCA attacks. While non-profiled attacks perform an attack in a single phase on a target device, profiled attacks consist of two phases, a profiling phase, to learn a leakage pattern and an attack phase, to attack with only a few traces, which practically operate on different devices. During the profiling stage, the attacker will collect traces from a ”profiling” device identical to the victim device to build a model. During the attack, this model is then used to recover cryptographic secrets from the victim device.

Template attacks have been shown (Chari et al., 2003) to be capable of recovering secret keys with a small number of traces, making them among the most powerful side channel attacks. More recently, supervised ML techniques have been used for profiling SCA (et al., 2013). Among these techniques, DNNs have been one of the most successful, defeating many common countermeasures, such as masking (Gilmore et al., 2015) and clock jitter (Cagli et al., 2017). Table 1 provides the summary of related works on profiling attacks. Till date, only one prior work (Carbone et al., 2019) has focused on cross-device EM ML SCA attack using only one test device running RSA. Note that this attack required a 3-class DNN (Carbone et al., 2019), whereas the proposed single-trace (averaged) EM-X-DL attack on AES-128 requires a 256-class DNN, and thus the effects of portability across devices is significantly more prominent. Additionally, AES measurements have significantly lower side-channel SNR compared to a public key algorithm such as RSA.

The EM probe used to collect both training and testing traces has an effect on the side-channel EM signals recorded. Two probes were considered, first a Langer probe with very high spatial sensitivity ($100\mu m$ diameter), and second a texbox probe with low spatial sensitivity ($10mm$ diameter). In order to estimate the leakage captured by each of the probes, test vector leakage assessment (TVLA) (Becker et al., 2013) was used to measure side channel leakage, scanning over the surface of one of the 8-bit X-MEGA devices under attack. The results of these scans can be seen in figure 6. As expected, the Langer probe finds high leakage in a very small area, while the larger probe detects leakage over a much larger area of the chip. Additionally, the larger probe detects a much higher level of leakage overall. Since the X-MEGA device is running a software implementation of AES-128, side-channel leakage is not highly localized, as it would be in a hardware implementation, and the high spatial sensitivity of the Langer probe does not provide a large benefit in rejecting algorithmic noise, as there is not a single register at which to target during an attack. For the rest of this work, results will be shown from the larger probe, as the leakage levels are already lower than power, and a variety of effects can be more easily investigated with the relatively higher leakage levels with the larger Tekbox probe - a t-value of 8 on the Langer probe vs. a t-value of 22 with the Tekbox probe, as seen in Figure 6.

Figure 3 shows the architecture of the proposed 256-class fully-connected (FC) DNN for the EM-X-DL attack. It should be noted that the EM traces captured using Chipwhisperer are time-synchronized and hence use of a convolutional layer is not necessary (Golder et al., 2019). 3000 time samples for each trace were collected from the 8-bit microcontrollers running AES-128 clocked at 7.37MHz.

The DNN, implemented using Tensorflow (Abadi et al., 2016), has a 3000-neuron input layer, followed by three hidden layers with 100, 1024, 512 neurons respectively, and finally the 256-neuron output layer. Rectified Linear Unit (ReLU) activation functions along with batch normalization and dropout used to achieve generalization are utilized for training the DNN. The Adam optimizer, with an initial learning rate of 0.005, which is halved whenever five consecutive training epochs pass without any validation accuracy improvement, is used for training. The effect of different hyperparameters is shown in Figure 5. A dropout of 0.45 is the most optimum for the first hidden layer (Figure 5(a)), while 1024 hidden neurons for the second hidden layer (Figure 5(b)) provides the maximum cross-device accuracy without overfitting to the training devices. For all the results that follow, unless otherwise mentioned, the DNN is trained with ten devices for 100 epochs with a batch size of 64.

Now, as the raw EM traces collected from the ten training devices (100K traces each) are fed to the DNN classifier, the validation accuracy remains low ($<1\%$) although training accuracy increases, even after 100 epochs. Figure 4 (blue curve) shows the effect of averaging on the same-device (test) accuracy. Even with $20\times$ averaging, the time-domain traces shows a test accuracy of $<1\%$, while a dimensionality reduction using PCA achieves $>99\%$ test accuracy for the same device. For cross-device attacks, the accuracy is lower, only 90% with $20\times$ averaging and PCA. Figure 9 shows this result in terms of SNR, and shows the DNN’s accuracy for lower levels of SNR as well (achieved by lowering the amount of averaging). As expected the accuracy lowers with the SNR, following a similar pattern to Figure 4. Next, we will look into the effect of augmenting traces from ten training devices along with $20\times$ averaging and different pre-processing strategies on the cross-device accuracy. Note that, unless otherwise specified, cross-device accuracy refers to the average key prediction accuracy of the EM-X-DL attack across all the ten test devices.

In the previous sub-section, it was shown that the averaged time-domain EM traces (100K $\times$ 10 devices) do not train the DNN efficiently, while dimensionality reduction techniques like PCA have a significant impact in training the DNN. Here, we study the effects of PCA (Golder et al., 2019), LDA  (Renauld et al., 2011) on the time-domain EM traces, as well as the effects of frequency domain based processing (FFT, spectrogram  (Rechberger and Oswald, 2005; Yang et al., 2019)) on the cross-device accuracy.

To address the first point, the effect of the subset, the EM-X-DL model is trained with a random subset of six devices, then tested against all the remaining fourteen devices. As shown in Figure 10, the average cross-device accuracy can vary greatly even for a set of only six devices, with accuracy ranging from 10% to 75% for different six-device combinations. This shows that there are subsets of training devices that can improve accuracy rather than simply adding more devices. However, as there are a large number of possible subsets for a given size, an algorithm is necessary to choose one such subset which results in high cross-device accuracy. Such an algorithm would then enable an attacker to gather quick measurements from a large set of devices, and determine a small subset of devices to collect a large number of traces from, for training the DNN model.

The proposed algorithm begins by identifying two points of interest (POIs) in the traces. This can be done through any POI identification technique, here POIs are chosen as time samples which have the highest difference of means (DOM). Once the top two POIs are found, the mean $\boldsymbol{\mu_{i}}=(\mu_{POI1},\mu_{POI2})$ of this POI pair is calculated across all traces for each device. Then, to construct the subset of devices for training, one device is initially chosen arbitrarily, and additional devices are added as follows: The mean POI pair of all devices currently included in the training subset, $\boldsymbol{\mu_{train}}$ is calculated. Then, the next device is chosen such that $||\boldsymbol{\mu_{i}}-\boldsymbol{\mu_{train}}||_{2}$ is maximized, where $i$ varies over all devices not already included in the training subset. In this way, at each step, the device whose top two average POIs are furthest from the average POIs of the currently selected devices is added to the training set. This method is detailed in Algorithm 1.

Figure 11 shows the 2-D bivariate normal distribution of the first three devices chosen using this algorithm, along with the total distribution of all devices. With these three devices, a large portion of the distribution spanned by all the devices is covered, revealing the successful operation of the algorithm. Importantly, this algorithm also provides the desired results during training, shown in Figure 12, as using this algorithm to choose the training devices gives higher cross-device (EM-X-DL) accuracy for any number of devices. Additionally, training with the devices closest to the current training set, as opposed to the furthest away, results in cross-device accuracy significantly lower than the maximally different devices, and generally lower accuracy than randomly selected devices as well. These results were obtained with the proposed 256-class DNN, using $20\times$ averaging and PCA-based pre-processing. From Figure 12, we also see that to attain a certain cross-device accuracy, this algorithm requires between $20\%-40\%$ fewer training devices compared to random device selection.