arXiv subjects

Shreyas Sen

Publications and source records attributed to Shreyas Sen.

At least 55 records · Page 3Linked to original sources

arXiv2020

EM-X-DL: Efficient Cross-Device Deep Learning Side-Channel Attack with Noisy EM Signatures

This work presents a Cross-device Deep-Learning based Electromagnetic (EM-X-DL) side-channel analysis (SCA), achieving >90% single-trace attack accuracy on AES-128, even in the presence of significantly lower signal-to-noise ratio (SNR), compared to the previous works. With an intelligent selection of multiple training devices and proper choice of hyperparameters, the proposed 256-class deep neural network (DNN) can be trained efficiently utilizing pre-processing techniques like PCA, LDA, and FFT on the target encryption engine running on an 8-bit Atmel microcontroller. Finally, an efficient end-to-end SCA leakage detection and attack framework using EM-X-DL demonstrates high confidence of an attacker with <20 averaged EM traces.

cs.CR↗

arXiv2020

Context-Aware Collaborative-Intelligence with Spatio-Temporal In-Sensor-Analytics in a Large-Area IoT Testbed

Decades of continuous scaling has reduced the energy of unit computing to virtually zero, while energy-efficient communication has remained the primary bottleneck in achieving fully energy-autonomous IoT nodes. This paper presents and analyzes the trade-offs between the energies required for communication and computation in a wireless sensor network, deployed in a mesh architecture over a 2400-acre university campus, and is targeted towards multi-sensor measurement of temperature, humidity and water nitrate concentration for smart agriculture. Several scenarios involving In-Sensor-Analytics (ISA), Collaborative Intelligence (CI) and Context-Aware-Switching (CAS) of the cluster-head during CI has been considered. A real-time co-optimization algorithm has been developed for minimizing the energy consumption in the network, hence maximizing the overall battery lifetime of individual nodes. Measurement results show that the proposed ISA consumes ~467X lower energy as compared to traditional Bluetooth Low Energy (BLE) communication, and ~69,500X lower energy as compared with Long Range (LoRa) communication. When the ISA is implemented in conjunction with LoRa, the lifetime of the node increases from a mere 4.3 hours to 66.6 days with a 230 mAh coin cell battery, while preserving more than 98% of the total information. The CI and CAS algorithms help in extending the worst-case node lifetime by an additional 50%, thereby exhibiting an overall network lifetime of ~104 days, which is >90% of the theoretical limits as posed by the leakage currents present in the system, while effectively transferring information sampled every second. A web-based monitoring system was developed to archive the measured data in a continuous manner, and to report anomalies in the measured data.

cs.NI↗

arXiv2020

A Wearable CMOS Biosensor with 3 Designs of Energy-Resolution Scalable Time-Based Resistance to Digital Converter

This paper presents the design and analysis of a wearable CMOS biosensor with three different designs of energy-resolution scalable time-based resistance to digital converters (RDC), targeted towards either minimizing the energy/conversion step or maximizing bit-resolution. The implemented RDCs consist of a 3-stage differential ring oscillator which is current starved with the resistive sensor, a differential to single ended amplifier, an off-chip counter and serial interface. The first design RDC included the basic structure of time-based RDC and targeted low energy/conversion step. The second design RDC aimed to improve the rms jitter/phase noise of the oscillator with help of speed-up latches, to achieve higher bit-resolution as compared to the first design RDC. The third design RDC reduced the power consumption by scaling the technology with the improved phase-noise design, achieving 1-bit better resolution as that of the second design RDC. Using a time-based implementation, the RDCs exhibit energy-resolution scalablity, and consume 861nW with 18-bit resolution in design 1 in TSMC 0.35um technology. Design 2 and 3 consume 19.1uW with 20-bit resolution using TSMC 0.35um, and 17.6uW with 20-bit resolutions using TSMC 0.18um, respectively (both with 10ms read-time, repeated every second). With 30ms read-time, design 3 achieves 21-bit resolution, which is the highest resolution reported for a time-based ADC. The 0.35um time-based RDC is the lowest-power time-based ADC reported, while the 0.18um time-based RDC with speed-up latch offers the highest resolution. The active chip-area for all 3-designs are less than 1.1 mm^2.

eess.SY↗

arXiv2020

In-The-Wild Interference Characterization and Modelling for Electro-Quasistatic-HBC with Miniaturized Wearables

The emergence of Human Body Communication (HBC) as an alternative to wireless body area networks (WBAN) has led to the development of small sized, energy efficient and more secure wearable and implantable devices forming a network in and around the body. Previous studies claim that though HBC is comparatively more secure than WBAN, nevertheless, the electromagnetic (EM) radiative nature of HBC in >10MHz region makes the information susceptible to eavesdropping. Furthermore, interferences may be picked up by the body due to the human body antenna effect in the 40-400MHz range. Alternatively, electro-quasistatic (EQS) mode of HBC forms an attractive way for covert data transmission in the sub 10MHz region by allowing the signal to be contained within the body. However, there is a gap in the knowledge about the mechanism and sources of interference in this region (crucial in allowing for proper choice of data transmission band). In this paper, the interference coupling modality in the EQS region is explained along with its possible sources. Interferences seen by the wearable in the actual scenario is a non-trivial problem and a suitable measurement EQS HBC setup is designed to recreate it by employing a wearable sized measurement setup having a small ground plane. For the first time, a human biophysical interference pickup model is proposed and interference measurement results using a wearable device are presented up to 250kHz in different environmental settings.

eess.SY↗

arXiv2020

Understanding The Role of Magnetic and Magneto-Quasistatic Fields in Human Body Communication

With the advent of wearable technologies, Human Body Communication (HBC) has emerged as a physically secure and power-efficient alternative to the otherwise ubiquitous Wireless Body Area Network (WBAN). Whereas the most investigated nodes of HBC have been Electric and Electro-quasistatic (EQS) Capacitive and Galvanic, recently Magnetic HBC (M-HBC) has been proposed as a viable alternative. Previous works have investigated M-HBC through an application point of view, without developing a fundamental working principle for the same. In this paper, for the first time, a ground up analysis has been performed to study the possible effects and contributions of the human body channel in M-HBC over a broad frequency range (1kHz to 10 GHz), by detailed electromagnetic simulations and supporting experiments. The results show that while M-HBC can be successfully operated as a body area network, the human body itself plays a minimal or negligible role in it's functionality. For frequencies less than about 30 MHz, in the domain of operation of Magneto-quasistatic (MQS) HBC, the human body is transparent to the quasistatic magnetic field. Conversely for higher frequencies, the conductive nature of human tissues end up attenuating Magnetic HBC fields due to Eddy currents induced in body tissues, eliminating the possibility of the body to support efficient waveguide modes. With this better understanding at hand, different modes of operations of MQS HBC have been outlined for both high impedance capacitive and 50 Ohm termination cases, and their performances have been compared with EQS HBC for similar sized devices, over varying distance between TX and RX. The resulting report presents the first fundamental understanding towards M-HBC operation and its contrast with EQS HBC, aiding HBC device designers to make educated design decisions, depending on mode of applications.

eess.SP↗

arXiv2020

Advanced Biophysical Model to Capture Channel Variability for EQS Capacitive HBC

Human Body Communication (HBC) has come up as a promising alternative to traditional radio frequency (RF) Wireless Body Area Network (WBAN) technologies. This is essentially due to HBC providing a broadband communication channel with enhanced signal security in the physical layer due to lower radiation from the human body as compared to its RF counterparts. An in-depth understanding of the mechanism for the channel loss variability and associated biophysical model needs to be developed before EQS-HBC can be used more frequently in WBAN consumer and medical applications. Biophysical models characterizing the human body as a communication channel didn't exist in literature for a long time. Recent developments have shown models that capture the channel response for fixed transmitter and receiver positions on the human body. These biophysical models do not capture the variability in the HBC channel for varying positions of the devices with respect to the human body. In this study, we provide a detailed analysis of the change in path loss in a capacitive-HBC channel in the electroquasistatic (EQS) domain. Causes of channel loss variability namely: inter-device coupling and effects of fringe fields due to body's shadowing effects are investigated. FEM based simulation results are used to analyze the channel response of human body for different positions and sizes of the device which are further verified using measurement results to validate the developed biophysical model. Using the bio-physical model, we develop a closed form equation for the path loss in a capacitive HBC channel which is then analyzed as a function of the geometric properties of the device and the position with respect to the human body which will help pave the path towards future EQSHBC WBAN design.

eess.SP↗

arXiv2020

Analysis and Design Considerations for Achieving the Fundamental Limits of Phase Noise in mmWave Oscillators with On-Chip MEMS Resonator

Very small electromechanical coupling coefficient in micro-electromechanical systems (MEMS) or acoustic resonators is quite of a concern for oscillator performance, specially at mmWave frequencies. This small coefficient is the manifestation of the small ratio of motional capacitance to static capacitance in the resonators. This work provides a general solution to overcome the problem of relatively high static capacitance at mmWave frequencies and presents analysis and design techniques for achieving extremely low phase noise and a very high figure-of-merit (FoM) in an on-chip MEMS resonator based mmWave oscillator. The proposed analysis and techniques are validated with design and simulation of a 30 GHz oscillator with MEMS resonator having quality factor of 10,000 in 14 nm GF technology. Post layout simulation results show that it achieves a phase noise of -132 dBc/Hz and FoM of 217 dBc/Hz at offset of 1 MHz.

eess.SP↗

arXiv2020

Electro-Quasistatic Animal Body Communication for Chronic Untethered Rodent Biopotential Recording

Continuous multi-channel monitoring of biopotential signals is vital in understanding the body as a whole, facilitating accurate models and predictions in neural research. The current state of the art in wireless technologies for untethered biopotential recordings rely on radiative electromagnetic (EM) fields. In such transmissions, only a small fraction of this energy is received since the EM fields are widely radiated resulting in lossy inefficient systems. Using the body as a communication medium (similar to a 'wire') allows for the containment of the energy within the body, yielding order(s) of magnitude lower loss than radiative EM communication. In this work, we introduce Animal Body Communication (ABC), which utilizes the concept of using the body as a medium into the domain of chronic animal biopotential recording. This work, for the first time, develops the theory and models for animal body communication circuitry and channel loss. Using this theoretical model, a sub-inch$^3$, custom-designed sensor node is built using off the shelf components which is capable of sensing and transmitting biopotential signals, through the body of the rat at significantly lower powers compared to traditional wireless transmissions. In-vivo experimental analysis proves that ABC successfully transmits acquired electrocardiogram (EKG) signals through the body with correlation accuracy >99% when compared to traditional wireless communication modalities, with a 50x reduction in power consumption.

eess.SP↗

arXiv2020

Theoretical Analysis of Multi Integrating RX Front-Ends for Lossy Broad-Band Channels

In this paper, we present a theoretical analysis of different integrating front-ends employed in broad-band communications through \textit{lossy} channels. Time-domain receivers for broad-band communication typically deal with large integrated noise due to its high bandwidth of operation. However, unlike traditional wireline systems that are typically not noise-limited, channels with high channel-loss render the input signal swing to be very small imposing several challenges in RX design as the circuits operate in the noise-limited regime. This simultaneous high integrated noise and low signal-swing limits the maximum achievable data-rate for a target bit-error-rate (BER) and deteriorates the energy-efficiency of the RX. In this work, transient, noise and gain performance of different standard signaling blocks have been obtained with closed-form expressions and are validated through spice-simulations. Multi-integrator cascade has been proposed which provides significant gain with relatively lower power consumption than the standard gain elements. Also, maximum achievable data-rate and optimum energy efficiency for different channel losses have been obtained theoretically for different architectures revealing their advantages and limitations. All the pertaining circuits have been designed in 65 nm CMOS process with a 1 V supply voltage.

eess.SP↗

arXiv2020

Inter-Body Coupling in Electro-Quasistatic Human Body Communication: Theory and Analysis of Security and Interference Properties

Radiative communication using electromagnetic fields is the backbone of today's wirelessly connected world, which implies that the physical signals are available for malicious interceptors to snoop within a 5-10 m distance, also increasing interference and reducing channel capacity. Recently, Electro-quasistatic (EQS) human body communication was demonstrated which utilizes the human body's conductive properties to communicate without radiating the signals outside the body. Previous experiments showed that an attack with an antenna is unsuccessful, more than 1 cm of the body surface and 15 cm of an EQS-HBC device. However, since this is a new communication modality, it calls for investigation of new attack modalities - that can potentially exploit the physics utilized in the EQS-HBC to break the system. In this study, we present a novel attack method for EQS-HBC devices, using the body of the attacker itself as a coupling surface and capacitive inter-body coupling between the user and the attacker. We develop theoretical understanding backed by experimental results for inter-body coupling, as a function of distance between the subjects. We utilize this newly developed understanding to design EQS-HBC transmitters to minimize the attack distance through inter-body coupling as well as minimize the interference among multiple EQS-HBC users due to inter-body coupling. This understanding allows us to develop more secure and robust EQS-HBC based body area networks in the future.

eess.SP↗

arXiv2020

Physical Time-Varying Transfer Functions as Generic Low-Overhead Power-SCA Countermeasure

Mathematically-secure cryptographic algorithms leak significant side channel information through their power supplies when implemented on a physical platform. These side channel leakages can be exploited by an attacker to extract the secret key of an embedded device. The existing state-of-the-art countermeasures mainly focus on the power balancing, gate-level masking, or signal-to-noise (SNR) reduction using noise injection and signature attenuation, all of which suffer either from the limitations of high power/area overheads, performance degradation or are not synthesizable. In this article, we propose a generic low-overhead digital-friendly power SCA countermeasure utilizing physical Time-Varying Transfer Functions (TVTF) by randomly shuffling distributed switched capacitors to significantly obfuscate the traces in the time domain. System-level simulation results of the TVTF-AES implemented in TSMC 65nm CMOS technology show > 4000x MTD improvement over the unprotected implementation with nearly 1.25x power and 1.2x area overheads, and without any performance degradation.

cs.CR↗

arXiv2020

SCNIFFER: Low-Cost, Automated, Efficient Electromagnetic Side-Channel Sniffing

Electromagnetic (EM) side-channel analysis (SCA) is a prominent tool to break mathematically-secure cryptographic engines, especially on resource-constrained IoT devices. Presently, to perform EM SCA on an embedded IoT device, the entire chip is manually scanned and the MTD (Minimum Traces to Disclosure) analysis is performed at each point on the chip to reveal the secret key of the encryption algorithm. However, an automated end-to-end framework for EM leakage localization, trace acquisition, and attack has been missing. This work proposes SCNIFFER: a low-cost, automated EM Side Channel leakage SNIFFing platform to perform efficient end-to-end Side-Channel attacks. Using a leakage measure such as TVLA, or SNR, we propose a greedy gradient-search heuristic that converges to one of the points of highest EM leakage on the chip (dimension: N x N) within O(N) iterations, and then perform Correlational EM Analysis (CEMA) at that point. This reduces the CEMA attack time by ~N times compared to an exhaustive MTD analysis, and >20x compared to choosing an attack location at random. We demonstrate SCNIFFER using a low-cost custom-built 3-D scanner with an H-field probe (<$500) compared to >$50,000 commercial EM scanners, and a variety of microcontrollers as the devices under attack. The SCNIFFER framework is evaluated for several cryptographic algorithms (AES-128, DES, RSA) running on both an 8-bit Atmega microcontroller and a 32-bit ARM microcontroller to find a point of high leakage and then perform a CEMA at that point.

cs.CR↗

arXiv2019

Practical Approaches Towards Deep-Learning Based Cross-Device Power Side Channel Attack

Power side-channel analysis (SCA) has been of immense interest to most embedded designers to evaluate the physical security of the system. This work presents profiling-based cross-device power SCA attacks using deep learning techniques on 8-bit AVR microcontroller devices running AES-128. Firstly, we show the practical issues that arise in these profiling-based cross-device attacks due to significant device-to-device variations. Secondly, we show that utilizing Principal Component Analysis (PCA) based pre-processing and multi-device training, a Multi-Layer Perceptron (MLP) based 256-class classifier can achieve an average accuracy of 99.43% in recovering the first key byte from all the 30 devices in our data set, even in the presence of significant inter-device variations. Results show that the designed MLP with PCA-based pre-processing outperforms a Convolutional Neural Network (CNN) with 4-device training by ~20%in terms of the average test accuracy of cross-device attack for the aligned traces captured using the ChipWhisperer hardware.Finally, to extend the practicality of these cross-device attacks, another pre-processing step, namely, Dynamic Time Warping (DTW) has been utilized to remove any misalignment among the traces, before performing PCA. DTW along with PCA followed by the 256-class MLP classifier provides >=10.97% higher accuracy than the CNN based approach for cross-device attack even in the presence of up to 50 time-sample misalignments between the traces.

eess.SP↗

arXiv2018

Characterization and Classification of Human Body Channel as a function of Excitation and Termination Modalities

Human Body Communication (HBC) has recently emerged as an alternative to radio frequency transmission for connecting devices on and in the human body with order(s) of magnitude lower energy. The communication between these devices can give rise to different scenarios, which can be classified as wearable-wearable, wearable-machine, machine-machine interactions. In this paper, for the first time, the human body channel characteristics is measured for a wide range of such possible scenarios (14 vs. a few in previous literature) and classified according to the form-factor of the transmitter and receiver. The effect of excitation/termination configurations on the channel loss is also explored, which helps explain the previously unexplained wide variation in HBC Channel measurements. Measurement results show that wearable-wearable interaction has the maximum loss (upto -50 dB) followed by wearable-machine and machinemachine interaction (min loss of 0.5 dB), primarily due to the small ground size of the wearable devices. Among the excitation configurations, differential excitation is suitable for small channel length whereas single ended is better for longer channel.

cs.HC↗

arXiv2018

RF-PUF: Enhancing IoT Security through Authentication of Wireless Nodes using In-situ Machine Learning

Traditional authentication in radio-frequency (RF) systems enable secure data communication within a network through techniques such as digital signatures and hash-based message authentication codes (HMAC), which suffer from key recovery attacks. State-of-the-art IoT networks such as Nest also use Open Authentication (OAuth 2.0) protocols that are vulnerable to cross-site-recovery forgery (CSRF), which shows that these techniques may not prevent an adversary from copying or modeling the secret IDs or encryption keys using invasive, side channel, learning or software attacks. Physical unclonable functions (PUF), on the other hand, can exploit manufacturing process variations to uniquely identify silicon chips which makes a PUF-based system extremely robust and secure at low cost, as it is practically impossible to replicate the same silicon characteristics across dies. Taking inspiration from human communication, which utilizes inherent variations in the voice signatures to identify a certain speaker, we present RF- PUF: a deep neural network-based framework that allows real-time authentication of wireless nodes, using the effects of inherent process variation on RF properties of the wireless transmitters (Tx), detected through in-situ machine learning at the receiver (Rx) end. The proposed method utilizes the already-existing asymmetric RF communication framework and does not require any additional circuitry for PUF generation or feature extraction. Simulation results involving the process variations in a standard 65 nm technology node, and features such as LO offset and I-Q imbalance detected with a neural network having 50 neurons in the hidden layer indicate that the framework can distinguish up to 4800 transmitters with an accuracy of 99.9% (~ 99% for 10,000 transmitters) under varying channel conditions, and without the need for traditional preambles.

cs.CR↗

arXiv2018

Exploiting Inherent Error-Resiliency of Neuromorphic Computing to achieve Extreme Energy-Efficiency through Mixed-Signal Neurons

Neuromorphic computing, inspired by the brain, promises extreme efficiency for certain classes of learning tasks, such as classification and pattern recognition. The performance and power consumption of neuromorphic computing depends heavily on the choice of the neuron architecture. Digital neurons (Dig-N) are conventionally known to be accurate and efficient at high speed, while suffering from high leakage currents from a large number of transistors in a large design. On the other hand, analog/mixed-signal neurons are prone to noise, variability and mismatch, but can lead to extremely low-power designs. In this work, we will analyze, compare and contrast existing neuron architectures with a proposed mixed-signal neuron (MS-N) in terms of performance, power and noise, thereby demonstrating the applicability of the proposed mixed-signal neuron for achieving extreme energy-efficiency in neuromorphic computing. The proposed MS-N is implemented in 65 nm CMOS technology and exhibits > 100X better energy-efficiency across all frequencies over two traditional digital neurons synthesized in the same technology node. We also demonstrate that the inherent error-resiliency of a fully connected or even convolutional neural network (CNN) can handle the noise as well as the manufacturing non-idealities of the MS-N up to certain degrees. Notably, a system-level implementation on MNIST datasets exhibits a worst-case increase in classification error by 2.1% when the integrated noise power in the bandwidth is ~ 0.1 uV2, along with +-3σ amount of variation and mismatch introduced in the transistor parameters for the proposed neuron with 8-bit precision.

cs.ET↗

arXiv2018

BioPhysical Modeling, Characterization and Optimization of Electro-Quasistatic Human Body Communication

Human Body Communication (HBC) has emerged as an alternative to radio wave communication for connecting low power, miniaturized wearable and implantable devices in, on and around the human body which uses the human body as the communication channel. Previous studies characterizing the human body channel has reported widely varying channel response much of which has been attributed to the variation in measurement setup. This calls for the development of a unifying bio physical model of HBC supported by in depth analysis and an understanding of the effect of excitation, termination modality on HBC measurements. This paper characterizes the human body channel up to 1MHz frequency to evaluate it as a medium for broadband communication. A lumped bio physical model of HBC is developed, supported by experimental validations that provides insight into some of the key discrepancies found in previous studies. Voltage loss measurements are carried out both with an oscilloscope and a miniaturized wearable prototype to capture the effects of non common ground. Results show that the channel loss is strongly dependent on the termination impedance at the receiver end, with up to 4dB variation in average loss for different termination in an oscilloscope and an additional 9 dB channel loss with wearable prototype compared to an oscilloscope measurement. The measured channel response with capacitive termination reduces low frequency loss and allows flat band transfer function down to 13 KHz, establishing the human body as a broadband communication channel. Analysis of the measured results and the simulation model shows that (1) high impedance (2) capacitive termination should be used at the receiver end for accurate voltage mode loss measurements of the HBC channel at low frequencies.

cs.ET↗

arXiv2018

RF-PUF: IoT Security Enhancement through Authentication of Wireless Nodes using In-situ Machine Learning

Physical unclonable functions (PUF) in silicon exploit die-to-die manufacturing variations during fabrication for uniquely identifying each die. Since it is practically a hard problem to recreate exact silicon features across dies, a PUFbased authentication system is robust, secure and cost-effective, as long as bias removal and error correction are taken into account. In this work, we utilize the effects of inherent process variation on analog and radio-frequency (RF) properties of multiple wireless transmitters (Tx) in a sensor network, and detect the features at the receiver (Rx) using a deep neural network based framework. The proposed mechanism/framework, called RF-PUF, harnesses already existing RF communication hardware and does not require any additional PUF-generation circuitry in the Tx for practical implementation. Simulation results indicate that the RF-PUF framework can distinguish up to 10000 transmitters (with standard foundry defined variations for a 65 nm process, leading to non-idealities such as LO offset and I-Q imbalance) under varying channel conditions, with a probability of false detection < 10e-3

cs.CR↗