sampling mesh monitor post: add pics
This commit is contained in:
parent
ebb0df945e
commit
7fefec320d
8 changed files with 57 additions and 0 deletions
BIN
content/blog/paper-sampling-mesh-monitor/fig_edge_risetime.pdf
Normal file
BIN
content/blog/paper-sampling-mesh-monitor/fig_edge_risetime.pdf
Normal file
Binary file not shown.
BIN
content/blog/paper-sampling-mesh-monitor/fig_edge_risetime.png
Normal file
BIN
content/blog/paper-sampling-mesh-monitor/fig_edge_risetime.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 87 KiB |
|
|
@ -5,6 +5,17 @@ summary: >
|
|||
foobar
|
||||
---
|
||||
|
||||
.. raw:: html
|
||||
|
||||
<figure data-pagefind-ignore>
|
||||
<img src="pic_board_setup_2_small.jpg" alt="A PCB with several chips sitting on a table with another PCB
|
||||
with only traces on it plugged in through a board-edge connector. The first PCB looks not very complex.">
|
||||
<figcaption>
|
||||
The final setup. On the right is the measurement board, and on the left is the mesh test specimen plugged
|
||||
in. In a real application, you would integrate both into your target circuit.
|
||||
</figcaption>
|
||||
</figure>
|
||||
|
||||
I've got a new paper accepted at CHES, to be published in TCHES 2026/1 around beginning of December and out
|
||||
`on eprint now <https://eprint.iacr.org/2025/1962>`__. The topic of the paper is a way of monitoring a tamper-sensing
|
||||
mesh through time-domain reflectometry using very cheap components. The end result is a circuit that costs about 10 € in
|
||||
|
|
@ -23,6 +34,19 @@ single analog measurement containing maybe 12 to 16 bits of entropy. There have
|
|||
RF techniques, but they all either required really expensive circuitry and/or highly customized meshes that for instance
|
||||
couldn't easily be fitted into arbitrary shapes.
|
||||
|
||||
.. raw:: html
|
||||
|
||||
<figure data-pagefind-ignore>
|
||||
<img src="fig_edge_risetime.png" alt="Four plots showing edge response for four different chips: 74LVC2G157,
|
||||
MAX3748, TDP0604 and PI3HDX12211. The first two are fairly slow at about 1 ns risetime, while the last two are
|
||||
very fast at around 300 ps risetime.">
|
||||
<figcaption>
|
||||
The sampling edges as measured by the board itself. As you can see, using a cheap microcontroller and some
|
||||
cheap display signal redriver ICs along with commodity RF schottkies you can get pretty spicy edges on a
|
||||
budget. <a href="fig_edge_risetime.pdf">Link to full resolution.</a>
|
||||
</figcaption>
|
||||
</figure>
|
||||
|
||||
In this paper, I wrote up a method using the high-resolution timer of an inexpensive `STM32G4-series microcontroller
|
||||
<https://www.st.com/resource/en/datasheet/stm32g474cb.pdf>`__ together with a DisplayPort/HDMI "redriver" chips meant for
|
||||
amplifying high-speed display signals to create fast pulse edges. I characterized several chips, with the best
|
||||
|
|
@ -32,6 +56,39 @@ fast edges generated by these drivers are then fed to a set of four-diode sampli
|
|||
to create a really cheap but fast time-domain reflectometer. Using this TDRD circuit, a security mesh can be monitored
|
||||
much more precisely than before, since the circuit creates a sort of fingerprint of the mesh's trace along its length.
|
||||
|
||||
.. raw:: html
|
||||
|
||||
<div class="subfigure" data-pagefind-ignore>
|
||||
<figure>
|
||||
<img src="pic_74lvc_small.jpg" alt="">
|
||||
<figcaption>
|
||||
74LVC2G157
|
||||
</figcaption>
|
||||
</figure>
|
||||
<figure>
|
||||
<img src="pic_max3748_small.jpg" alt="">
|
||||
<figcaption>
|
||||
MAX3748
|
||||
</figcaption>
|
||||
</figure>
|
||||
<figure>
|
||||
<img src="pic_tdp0604_small.jpg" alt="">
|
||||
<figcaption>
|
||||
TDP0604
|
||||
</figcaption>
|
||||
</figure>
|
||||
<figure>
|
||||
<img src="pic_pi3hdx_small.jpg" alt="">
|
||||
<figcaption>
|
||||
PI3HDX12211
|
||||
</figcaption>
|
||||
</figure>
|
||||
</div>
|
||||
|
||||
One of the fun highlights of this project to me was micro-soldering test boards using different redriver ICs. Above, you
|
||||
can see the result of that soldering work. I was really happy with my cheap aliexpress microscope and with my fancy
|
||||
titanium tweezers!
|
||||
|
||||
Have a look into the paper, where I wrote up details on the circuitry as well as a whole bunch of (>1000!) measurements
|
||||
characterizing the system. As it turns out, it's really sensitive to attacks while being reasonably robust to
|
||||
environmental disturbances. In fact, it's so sensitive that the circuit can distinguish multiple identical (!) copies of
|
||||
|
|
|
|||
BIN
content/blog/paper-sampling-mesh-monitor/pic_74lvc_small.jpg
Normal file
BIN
content/blog/paper-sampling-mesh-monitor/pic_74lvc_small.jpg
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 100 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 744 KiB |
BIN
content/blog/paper-sampling-mesh-monitor/pic_max3748_small.jpg
Normal file
BIN
content/blog/paper-sampling-mesh-monitor/pic_max3748_small.jpg
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 104 KiB |
BIN
content/blog/paper-sampling-mesh-monitor/pic_pi3hdx_small.jpg
Normal file
BIN
content/blog/paper-sampling-mesh-monitor/pic_pi3hdx_small.jpg
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 104 KiB |
BIN
content/blog/paper-sampling-mesh-monitor/pic_tdp0604_small.jpg
Normal file
BIN
content/blog/paper-sampling-mesh-monitor/pic_tdp0604_small.jpg
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 100 KiB |
Loading…
Add table
Add a link
Reference in a new issue