Give all figures and tables concise short titles
This commit is contained in:
jaseg
parent
38ee47fbc3
commit
210d82e57d
8 changed files with 144 additions and 121 deletions
|
|
@ -292,9 +292,10 @@ devices we selected for this study.
|
|||
H31 & PED & SumUp & SumUp 3G & 2019 \\
|
||||
H32 & PED & SumUp & SumUp Air & 2022 \\
|
||||
\end{tabular}
|
||||
\caption{The specimens we dissected in our survey. PED stands for \emph{Pin Entry Device}, the industry term for
|
||||
card payment terminals that have sufficient security to handle credit card PINs. EPP stands for \emph{Encrypting
|
||||
Pin Pad}, the type of keypad used for pin entry on ATMs. HSM stands for Hardware Security Module.}
|
||||
\caption[Tamper sensing mesh survey specimen list]{The specimens we dissected in our survey. PED stands for
|
||||
\emph{Pin Entry Device}, the industry term for card payment terminals that have sufficient security to handle
|
||||
credit card PINs. EPP stands for \emph{Encrypting Pin Pad}, the type of keypad used for pin entry on ATMs. HSM
|
||||
stands for Hardware Security Module.}
|
||||
\label{tab_hsm_survey_sample_list}
|
||||
\end{table}
|
||||
|
||||
|
|
@ -339,7 +340,7 @@ devices we selected for this study.
|
|||
\surveypic{31}{survey_diag_S31.jpg}\\
|
||||
\surveypic{32}{survey_diag_S32.jpg}&
|
||||
\end{tabular}
|
||||
\caption{External photos of all survey specimens.}
|
||||
\caption[Tamper sensing mesh survey specimen external photos]{External photos of all survey specimens.}
|
||||
\label{fig_hsm_survey_sample_pics}
|
||||
\end{figure}
|
||||
|
||||
|
|
@ -470,7 +471,7 @@ necessary to soften polymer compounds and to break glue joints.
|
|||
% overlapping the previous row
|
||||
\rule{0pt}{25mm}
|
||||
\end{tabular}
|
||||
\caption{Internal overview photos of the survey specimens.}
|
||||
\caption[Tamper sensing mesh survey specimen internal photos]{Internal overview photos of the survey specimens.}
|
||||
\label{fig_hsm_survey_sample_internal_pics}
|
||||
\end{figure}
|
||||
|
||||
|
|
@ -598,7 +599,8 @@ list, we will address several common structural features that we observed across
|
|||
\caption{Screen printing process using carbon ink (specimen~\sampleno{H30}).}
|
||||
\label{hsm_fig_materials_carbon_ink}
|
||||
\end{subfigure}
|
||||
\caption[Mesh materials]{Materials and manufacturing processes used for mesh traces and contacts.}
|
||||
\caption[Mesh materials and manufacturing processes]{Materials and manufacturing processes used for mesh traces and
|
||||
contacts.}
|
||||
\label{hsm_fig_materials}
|
||||
\end{figure}
|
||||
|
||||
|
|
|
|||
|
|
@ -67,10 +67,10 @@ This chapter contains the following contributions:
|
|||
\begin{figure}
|
||||
\center
|
||||
\includegraphics[width=12cm]{prototype_pic2.jpg}
|
||||
\caption{The prototype as we used it to test power transfer and bidirectional communication between stator and
|
||||
rotor. This picture shows the proof-of-concept prototype's configuration that we used for accelerometer
|
||||
characterization (Section~\ref{sec_accel_meas}) without the vertical security mesh struts that connect the circular
|
||||
top and bottom outer meshes.}
|
||||
\caption[Inertial HSM prototype]{The prototype as we used it to test power transfer and bidirectional communication
|
||||
between stator and rotor. This picture shows the proof-of-concept prototype's configuration that we used for
|
||||
accelerometer characterization (Section~\ref{sec_accel_meas}) without the vertical security mesh struts that connect
|
||||
the circular top and bottom outer meshes.}
|
||||
\label{prototype_picture}
|
||||
\end{figure}
|
||||
|
||||
|
|
@ -335,8 +335,8 @@ shaft penetrates the mesh to simplify mechanical construction.
|
|||
\begin{figure}
|
||||
\center
|
||||
\includegraphics{concept_vis_one_axis.pdf}
|
||||
\caption{Concept of a simple spinning Inertial HSM. 1 - Shaft. 2 - Security mesh. 3 - Payload. 4 -
|
||||
Accelerometer. 5 - Shaft penetrating security mesh.}
|
||||
\caption[Inertial HSM concept visualization]{Concept of a simple spinning Inertial HSM. 1 - Shaft. 2 - Security
|
||||
mesh. 3 - Payload. 4 - Accelerometer. 5 - Shaft penetrating security mesh.}
|
||||
\label{fig_schema_one_axis}
|
||||
\end{figure}
|
||||
|
||||
|
|
@ -586,11 +586,11 @@ kind of mechanical tool.
|
|||
\begin{figure}
|
||||
\center
|
||||
\includegraphics[width=6cm]{attack-robot.pdf}
|
||||
\caption{Schematic overview of a robotic rotating-stage attack. An optical sensor (1) observes the IHSM's rotation
|
||||
and adjusts the setpoint of a servo motor (2) that rotates the attack stage (3). On the rotating attack stage, a
|
||||
remote-controlled manipulator (4) is mounted that deactivates the security mesh (7) and creates an opening (5).
|
||||
Through this opening, a human operator can then insert tools such as probes to read out sensitive information from
|
||||
the actual payload (6).}
|
||||
\caption[Inertial HSM attack robot scenario]{Schematic overview of a robotic rotating-stage attack. An optical
|
||||
sensor (1) observes the IHSM's rotation and adjusts the setpoint of a servo motor (2) that rotates the attack stage
|
||||
(3). On the rotating attack stage, a remote-controlled manipulator (4) is mounted that deactivates the security mesh
|
||||
(7) and creates an opening (5). Through this opening, a human operator can then insert tools such as probes to read
|
||||
out sensitive information from the actual payload (6).}
|
||||
\label{fig_attack_robot}
|
||||
\end{figure}
|
||||
|
||||
|
|
@ -650,7 +650,8 @@ same effect. Figure~\ref{shaft_cm} shows variations of the shaft interface with
|
|||
\caption{A second moving tamper detection mesh also enables more complex topographies.}
|
||||
\label{shaft_cm_a}
|
||||
\end{subfigure}
|
||||
\caption{Mechanical countermeasures to attacks through or close to the shaft of a fixed-axis rotating IHSM.}
|
||||
\caption[IHSM shaft mechanical attack countermeasures]{Mechanical countermeasures to attacks through or close to the
|
||||
shaft of a fixed-axis rotating IHSM.}
|
||||
\label{shaft_cm}
|
||||
\end{figure}
|
||||
|
||||
|
|
@ -756,7 +757,7 @@ files.
|
|||
\center
|
||||
\caption{Assembled mechanical prototype rotor (left) and stator (right) PCB components.}
|
||||
\end{subfigure}
|
||||
\caption{Our proof-of-concept prototype IHSM's PCB security mesh design}
|
||||
\caption[IHSM PCB rotor and stator prototypes]{Our proof-of-concept prototype IHSM's PCB security mesh design}
|
||||
\label{fig_proto_mesh}
|
||||
\end{figure}
|
||||
|
||||
|
|
@ -775,7 +776,7 @@ files.
|
|||
\caption{Detail of a PCB produced with a generated mesh.}
|
||||
\label{mesh_gen_sample}
|
||||
\end{subfigure}
|
||||
\caption{Our automatic security mesh generation process}
|
||||
\caption[Automatic security mesh generation process visualization]{Our automatic security mesh generation process}
|
||||
\label{mesh_gen_fig}
|
||||
\end{figure}
|
||||
|
||||
|
|
@ -855,7 +856,7 @@ are shielded from one another by the motor's body in the center of the PCB.
|
|||
stray capacitances.}
|
||||
\label{photolink_schematic}
|
||||
\end{subfigure}
|
||||
\caption{IR data link implementation}
|
||||
\caption[IHSM IR data link implementation]{IR data link implementation}
|
||||
\end{figure}
|
||||
|
||||
\subsection{Evaluation}
|
||||
|
|
@ -965,10 +966,10 @@ the fly, without stopping the rotor.
|
|||
\begin{figure}
|
||||
\center
|
||||
\includegraphics[width=0.7\textwidth]{fig-acc-theory-meas-run50.pdf}
|
||||
\caption{Centrifugal acceleration versus angular frequency in theory and in our experiments. Experimental
|
||||
measurements are shown after correction for offset and scale error. Above \SI{300}{rpm}, the relative error is
|
||||
below $\SI{0.5}{\percent}$. Below $\SI{300}{rpm}$, the residual offset error has a large impact ($0.05\,g$ absolute
|
||||
or $8\%$ relative at $\SI{95}{rpm}$.)}
|
||||
\caption[Centrifugal acceleration versus angular frequency]{Centrifugal acceleration versus angular frequency in
|
||||
theory and in our experiments. Experimental measurements are shown after correction for offset and scale error.
|
||||
Above \SI{300}{rpm}, the relative error is below $\SI{0.5}{\percent}$. Below $\SI{300}{rpm}$, the residual
|
||||
offset error has a large impact ($0.05\,g$ absolute or $8\%$ relative at $\SI{95}{rpm}$.)}
|
||||
\label{fig-acc-theory}
|
||||
\end{figure}
|
||||
|
||||
|
|
|
|||
|
|
@ -28,14 +28,14 @@ While at a glance it might sound like a fringe position held by people from the
|
|||
it enjoys support far beyond those circles and throughout mainstream academic cryptography. The aversion of
|
||||
cryptographers against backdoor access shows up everywhere. From cryptographic protocol standards like TLS, to
|
||||
cryptographic applications like the Signal messenger, backdoor access is not only excluded from the system design, its
|
||||
possibility is considered a potential vulnerability. Measures such as forward secrecy and post-compromise security are
|
||||
taken to mitigate its impact. In computing, this design aspect makes cryptographic protocols a unique holdout. In other
|
||||
parts of the stack, explicit or implicit backdoor access is commonplace, and attempts at preventing it are rare. For
|
||||
instance, network providers are generally required to comply with so-called \emph{Lawful Interception} orders on
|
||||
particular customers or traffic types, and datacenter operators commonly provide hardware access to state authorities.
|
||||
The design decisions in cryptographic protocols generally hold, and the gold standard for backdoor access to modern
|
||||
systems is either exploiting a \emph{zero-day} flaw that is not yet publically known, or acquiring physical access to
|
||||
the target system. \todo{Make sure all figures have nice short titles for list of figures}
|
||||
possibility is considered a potential vulnerability.
|
||||
% Measures such as forward secrecy and post-compromise security are taken to mitigate its impact. In computing, this
|
||||
% design aspect makes cryptographic protocols a unique holdout. In other parts of the stack, explicit or implicit
|
||||
% backdoor access is commonplace, and attempts at preventing it are rare. For instance, network providers are generally
|
||||
% required to comply with so-called \emph{Lawful Interception} orders on particular customers or traffic types, and
|
||||
% datacenter operators commonly provide hardware access to state authorities. The design decisions in cryptographic
|
||||
% protocols generally hold, and the gold standard for backdoor access to modern systems is either exploiting a
|
||||
% \emph{zero-day} flaw that is not yet publically known, or acquiring physical access to the target system.
|
||||
|
||||
\section{Research Questions}
|
||||
|
||||
|
|
|
|||
|
|
@ -64,8 +64,9 @@ circuits.
|
|||
\subcaptionbox{\raggedright Our proposed inductor layout}{
|
||||
\includegraphics[width=0.28\textwidth]{svg_vis_paper.png}}
|
||||
\end{center}
|
||||
\caption{Illustration of our proposed inductor layout compared to contemporary conventional planar inductors and
|
||||
honeycomb as well as basket-woven coils from the early days of wireless radio.}
|
||||
\caption[Planar inductor layout comparison]{Illustration of our proposed inductor layout compared to contemporary
|
||||
conventional planar inductors and honeycomb as well as basket-woven coils from the early days of wireless
|
||||
radio.}
|
||||
\label{fig_illust_honeycomb_basket}
|
||||
\end{figure}
|
||||
|
||||
|
|
@ -378,9 +379,9 @@ scheme~\cite{lopeFirstSelfResonant2021,sproHighVoltageInsulationDesign2021,leePr
|
|||
\begin{center}
|
||||
\includegraphics[width=\textwidth]{nk_combined.pdf}
|
||||
\end{center}
|
||||
\caption{Inductor layouts for several sets of turn count $n$ and inversion count $k$. The top row shows the actual
|
||||
trace layout in cartesian coordinates, the bottom row visualizes the winding schema.
|
||||
}
|
||||
\caption[Basic twisted planar inductor layouts]{Inductor layouts for several sets of turn count $n$ and inversion
|
||||
count $k$. The top row shows the actual trace layout in cartesian coordinates, the bottom row visualizes the
|
||||
winding schema.}
|
||||
\label{fig_nk_combined}
|
||||
\end{figure}
|
||||
|
||||
|
|
@ -388,8 +389,9 @@ scheme~\cite{lopeFirstSelfResonant2021,sproHighVoltageInsulationDesign2021,leePr
|
|||
\begin{center}
|
||||
\includegraphics[width=\textwidth]{nk_complex_illust.pdf}
|
||||
\end{center}
|
||||
\caption{Layout examples for a number of combinations of turn count $n$ and inversion count $k$. Note that in this
|
||||
illustration we chose values for $n$ and $k$ such that all pairs are coprime.}
|
||||
\caption[Complex twisted planar inductor layout variants]{Layout examples for a number of combinations of turn count
|
||||
$n$ and inversion count $k$. Note that in this illustration we chose values for $n$ and $k$ such that all pairs
|
||||
are coprime.}
|
||||
\label{fig_nk_complex_illust}
|
||||
\end{figure}
|
||||
|
||||
|
|
@ -670,10 +672,11 @@ additional cost and without compromising other performance parameters.
|
|||
$25$& $37$& $18.15$& $6.0$& $2.0197$& $15.9$& $17.100$& $0.2$& $2.000$& $15.1$& $\textbf{17.066}$& $10.31$& $1.698$\\
|
||||
|
||||
\end{tabular}
|
||||
\caption{Inductor sample design parameters and measured characteristics. All inductors have outer diameter
|
||||
\qty{35}{\milli\meter} and inner diameter \qty{15}{\milli\meter}. The missing values in the simulation results
|
||||
columns result from the solver failing to converge. Bolded values highlight the best performing coil of each
|
||||
turn count. Shaded rows indicate conventional two-layer planar inductors ($k=1$).}
|
||||
\caption[Inductor sample design parameters and measured characteristics.]{Inductor sample design parameters and
|
||||
measured characteristics. All inductors have outer diameter \qty{35}{\milli\meter} and inner diameter
|
||||
\qty{15}{\milli\meter}. The missing values in the simulation results columns result from the solver failing to
|
||||
converge. Bolded values highlight the best performing coil of each turn count. Shaded rows indicate conventional
|
||||
two-layer planar inductors ($k=1$).}
|
||||
\label{tab_coupons}
|
||||
\end{sidewaystable}
|
||||
|
||||
|
|
@ -740,9 +743,9 @@ indicating a contribution from flux linkage.
|
|||
$75$&$90$&$53$ &$320$& $461$& $76.2$& $8.75$& $0.72$\\
|
||||
$75$&$90$&$53$ &$480$& $\mathbf{470}$& $92.9$& $8.00$& $0.84$\\
|
||||
\end{tabular}
|
||||
\caption{Parameters and measurement results of a set of larger sample inductors. Bold values indicate best
|
||||
performance at a given size. Shaded rows indicate conventional planar toroidal ($n=1$) or two-layer planar
|
||||
spiral inductors ($k=1$).}
|
||||
\caption[Parameters and measurement results of larger sample inductors.]{Parameters and measurement results of a set
|
||||
of larger sample inductors. Bold values indicate best performance at a given size. Shaded rows indicate
|
||||
conventional planar toroidal ($n=1$) or two-layer planar spiral inductors ($k=1$).}
|
||||
\label{tab_wide_coils}
|
||||
\end{table}
|
||||
|
||||
|
|
@ -760,9 +763,9 @@ angles to one another.
|
|||
\begin{center}
|
||||
\includegraphics[width=.65\textwidth]{test_schematic.pdf}
|
||||
\end{center}
|
||||
\caption{The test schematic used in all measurements. For direct coupling factor measurements, the load resistor was
|
||||
disconnected. We measure voltage at the output of the function generator to account for drop in its internal output
|
||||
resistance.}
|
||||
\caption[Planar inductor test schematic]{The test schematic used in all measurements. For direct coupling factor
|
||||
measurements, the load resistor was disconnected. We measure voltage at the output of the function generator to
|
||||
account for drop in its internal output resistance.}
|
||||
\label{fig_test_schematic}
|
||||
\end{figure}
|
||||
|
||||
|
|
@ -775,10 +778,10 @@ using Keysight 34465A multimeters in AC Root Mean Square (RMS) mode.
|
|||
\begin{center}
|
||||
\includegraphics[width=0.8\textwidth]{symmetry_3turn_n_twist.pdf}
|
||||
\end{center}
|
||||
\caption{RMS output voltage of the test circuit from Figure\ \ref{fig_test_schematic} for three pairs of matching
|
||||
inductors with one inductor rotating w.r.t.\ the other. The inductors have $n=3$ turns each and $k=\frac{1}{2}$,
|
||||
$k=1$, and $k=3$, respectively. For each $k$, voltage curves are plotted for a number of different radial offsets
|
||||
between the two inductor's centers.}
|
||||
\caption[Planar inductor voltage ripple versus rotation angle]{RMS output voltage of the test circuit from Figure\
|
||||
\ref{fig_test_schematic} for three pairs of matching inductors with one inductor rotating w.r.t.\ the other. The
|
||||
inductors have $n=3$ turns each and $k=\frac{1}{2}$, $k=1$, and $k=3$, respectively. For each $k$, voltage
|
||||
curves are plotted for a number of different radial offsets between the two inductor's centers.}
|
||||
\label{fig_symmetry_3turn_n_twist}
|
||||
\end{figure}
|
||||
|
||||
|
|
@ -810,12 +813,12 @@ pitch, as their turns deviate the furthest from a set of ideal, concentric circl
|
|||
\begin{center}
|
||||
\includegraphics[width=.65\textwidth]{k_ripple_plot.pdf}
|
||||
\end{center}
|
||||
\caption{RMS Voltage ripple in a model rotating WPT setup with $R_L=\qty{10}{\ohm}$ as a percentage of total RMS
|
||||
output voltage, plotted against inductor inversion count $k$. Measurements were taken with a number of different
|
||||
coils with turn count $n$ between a single turn and $25$ turns. Measurements were taken at two different radial coil
|
||||
offsets of $r=\qty{1}{\milli\meter}$ and $\qty{4}{\milli\meter}$. Coil distance was $d=\qty{1}{\milli\meter}$ in all
|
||||
cases. The shaded area indicates conventional coil layouts, with the remainder of the plot showing twisted
|
||||
inductors.}
|
||||
\caption[Planar inductor voltage ripple versus design parameter]{RMS Voltage ripple in a model rotating WPT setup
|
||||
with $R_L=\qty{10}{\ohm}$ as a percentage of total RMS output voltage, plotted against inductor inversion count
|
||||
$k$. Measurements were taken with a number of different coils with turn count $n$ between a single turn and $25$
|
||||
turns. Measurements were taken at two different radial coil offsets of $r=\qty{1}{\milli\meter}$ and
|
||||
$\qty{4}{\milli\meter}$. Coil distance was $d=\qty{1}{\milli\meter}$ in all cases. The shaded area indicates
|
||||
conventional coil layouts, with the remainder of the plot showing twisted inductors.}
|
||||
\label{fig_k_ripple_plot}
|
||||
\end{figure}
|
||||
|
||||
|
|
@ -838,12 +841,13 @@ pitch, as their turns deviate the furthest from a set of ideal, concentric circl
|
|||
\begin{center}
|
||||
\includegraphics[width=.65\textwidth]{rms_ripple_double_rotation_n3_r4.pdf}
|
||||
\end{center}
|
||||
\caption{RMS ripple magnitude as a percentage of mean RMS output voltage, plotted against the rotation of each of
|
||||
the two inductors. The two coils were kept at a constant \qty{4}{\milli\meter} radial offset, and the output coil
|
||||
was loaded with a \qty{10}{\ohm} load. All RMS ripple plots in this chapter share the same color scale to allow for
|
||||
visual comparison. This figure shows four variants of 3-turn coils, plots for $n=5$ can be found in Figure\
|
||||
\ref{fig_rms_ripple_n5} and plots for $n=\{10,25\}$ in Figures \ref{fig_rms_ripple_n10} and
|
||||
\ref{fig_rms_ripple_n25}.}
|
||||
\caption[Planar inductor voltage ripple versus both angles for $n=3, k=\{0,1,4\}$]{RMS ripple magnitude as a
|
||||
percentage of mean RMS output voltage, plotted against the rotation of each of the two inductors. The two coils
|
||||
were kept at a constant \qty{4}{\milli\meter} radial offset, and the output coil was loaded with a
|
||||
\qty{10}{\ohm} load. All RMS ripple plots in this chapter share the same color scale to allow for visual
|
||||
comparison. This figure shows four variants of 3-turn coils, plots for $n=5$ can be found in Figure\
|
||||
\ref{fig_rms_ripple_n5} and plots for $n=\{10,25\}$ in Figures \ref{fig_rms_ripple_n10} and
|
||||
\ref{fig_rms_ripple_n25}.}
|
||||
\label{fig_rms_ripple_n3}
|
||||
\end{figure}
|
||||
|
||||
|
|
@ -851,7 +855,8 @@ pitch, as their turns deviate the furthest from a set of ideal, concentric circl
|
|||
\begin{center}
|
||||
\includegraphics[width=.65\textwidth]{rms_ripple_double_rotation_n10_r4.pdf}
|
||||
\end{center}
|
||||
\caption{RMS ripple magnitude as shown in Figure\ \ref{fig_rms_ripple_n3} for four different 10-turn coils.}
|
||||
\caption[Planar inductor voltage ripple versus both angles for $n=10, k=\{0,1,3,7\}$]{RMS ripple magnitude as shown
|
||||
in Figure\ \ref{fig_rms_ripple_n3} for four different 10-turn coils.}
|
||||
\label{fig_rms_ripple_n10}
|
||||
\end{figure}
|
||||
|
||||
|
|
@ -859,7 +864,8 @@ pitch, as their turns deviate the furthest from a set of ideal, concentric circl
|
|||
\begin{center}
|
||||
\includegraphics[width=.65\textwidth]{rms_ripple_double_rotation_n25_r4.pdf}
|
||||
\end{center}
|
||||
\caption{RMS ripple magnitude as shown in Figure\ \ref{fig_rms_ripple_n3} for four different 25-turn coils.}
|
||||
\caption[Planar inductor voltage ripple versus both angles for $n=25, k=\{0,1,3,13\}$]{RMS ripple magnitude as shown
|
||||
in Figure\ \ref{fig_rms_ripple_n3} for four different 25-turn coils.}
|
||||
\label{fig_rms_ripple_n25}
|
||||
\end{figure}
|
||||
|
||||
|
|
@ -867,7 +873,8 @@ pitch, as their turns deviate the furthest from a set of ideal, concentric circl
|
|||
\begin{center}
|
||||
\includegraphics[width=.65\textwidth]{rms_ripple_double_rotation_n5_r4.pdf}
|
||||
\end{center}
|
||||
\caption{RMS ripple magnitude as shown in Figure\ \ref{fig_rms_ripple_n3} for four different 5-turn coils.}
|
||||
\caption[Planar inductor voltage ripple versus both angles for $n=5, k=\{0,1,3,7\}$]{RMS ripple magnitude as shown
|
||||
in Figure\ \ref{fig_rms_ripple_n3} for four different 5-turn coils.}
|
||||
\label{fig_rms_ripple_n5}
|
||||
\end{figure}
|
||||
|
||||
|
|
|
|||
|
|
@ -40,7 +40,7 @@ requirements of a QKD system.
|
|||
\begin{center}
|
||||
\includegraphics[width=0.7\textwidth]{fiber_passthrough_mech_model__8290_small_annotations.pdf}
|
||||
\end{center}
|
||||
\caption{Photo of our mechanical prototype.
|
||||
\caption[QKD fiber passthrough prototype mechanical prototype]{Photo of our mechanical prototype.
|
||||
1 - Bracket connecting payload and shaft with hidden spiral conduit for optical fibers.
|
||||
2 - Upper tamper sensing mesh PCB.
|
||||
3 - Outer IHSM tamper sensing mesh cage.
|
||||
|
|
@ -434,13 +434,13 @@ resulted in a difference below the measurement floor of approximately \qty{0.25}
|
|||
\hspace*{5mm}
|
||||
\includegraphics[width=0.45\textwidth]{fiber_passthrough_mech_model__8292_small.jpg}
|
||||
\end{center}
|
||||
\caption{An disassembled view of our optical passthrough mechanical prototype. The fiber is passed through from the
|
||||
shaft going through the IHSM's primary tamper sensing mesh cage to the outside into the interior of the IHSM through
|
||||
the green bracket. A secondary tamper sensing mesh is located on the inside of the shaft interface and driven
|
||||
separately. In this prototype, the secondary mesh is driven by a cooling fan. Both independently rotating meshes
|
||||
have tabs that extend into the bracket such that they do not interfere, but reduce the space available to an
|
||||
attacker. The HSM's primary mesh cage is partially shown in white.
|
||||
}
|
||||
\caption[QKD fiber passthrough mechanical model components]{A disassembled view of our optical passthrough
|
||||
mechanical prototype. The fiber is passed through from the shaft going through the IHSM's primary tamper sensing
|
||||
mesh cage to the outside into the interior of the IHSM through the green bracket. A secondary tamper sensing
|
||||
mesh is located on the inside of the shaft interface and driven separately. In this prototype, the secondary
|
||||
mesh is driven by a cooling fan. Both independently rotating meshes have tabs that extend into the bracket such
|
||||
that they do not interfere, but reduce the space available to an attacker. The HSM's primary mesh cage is
|
||||
partially shown in white.}
|
||||
\label{fig_pic_proto_detail}
|
||||
\end{figure}
|
||||
|
||||
|
|
|
|||
|
|
@ -54,9 +54,10 @@ specialty components.
|
|||
\begin{figure}
|
||||
\centering
|
||||
\includegraphics[width=0.6\textwidth]{pic_board_setup_2_small.jpg}
|
||||
\caption{Measurement setup. Shown are the test specimen board on the left, and the frontend board with one of the
|
||||
four pulse amplifiers in the center. The frontend board is powered through a USB-C connection, and data is sent to a
|
||||
computer through a Single-Wire Debug (SWD) interface. The grid in the background has \qty{10}{\milli\meter} pitch.}
|
||||
\caption[Sampling mesh monitor prototype and test coupon]{Measurement setup. Shown are the test specimen board on
|
||||
the left, and the frontend board with one of the four pulse amplifiers in the center. The frontend board is
|
||||
powered through a USB-C connection, and data is sent to a computer through a Single-Wire Debug (SWD) interface.
|
||||
The grid in the background has \qty{10}{\milli\meter} pitch.}
|
||||
\label{fig_pic_board}
|
||||
\end{figure}
|
||||
|
||||
|
|
@ -399,7 +400,8 @@ attack tools, or specialized tools for large-scale industrial manufacturing such
|
|||
\centering
|
||||
\hspace*{-7mm}
|
||||
\includegraphics[height=80mm]{block_diagram.pdf}
|
||||
\caption{Block diagram of our prototype sampling TDR security mesh monitoring circuit.}
|
||||
\caption[Sampling mesh monitor circuit block diagram]{Block diagram of our prototype sampling TDR security mesh
|
||||
monitoring circuit.}
|
||||
\label{fig_block_diagram}
|
||||
\end{figure}
|
||||
|
||||
|
|
@ -480,10 +482,10 @@ such as the CML-output comparators made by Analog Devices due to cost.
|
|||
\includegraphics[width=0.9\textwidth]{pic_pi3hdx_small.jpg}
|
||||
\caption{PI3HDX12211}
|
||||
\end{subfigure}
|
||||
\caption{Implementation of the pulse amplifier variants of the design. Amplifiers were mounted dead bug style on
|
||||
copper tape and connected with \qty{120}{\micro\meter} wire. Supply rails were connected with copper tape where
|
||||
possible to reduce impedance. MLCC power supply decoupling capacitors were placed on the copper tape to reduce loop
|
||||
area.}
|
||||
\caption[Sampling mesh monitor pulse amplifier implementations]{Implementation of the pulse amplifier variants of
|
||||
the design. Amplifiers were mounted dead bug style on copper tape and connected with \qty{120}{\micro\meter}
|
||||
wire. Supply rails were connected with copper tape where possible to reduce impedance. MLCC power supply
|
||||
decoupling capacitors were placed on the copper tape to reduce loop area.}
|
||||
\label{fig_pic_amps}
|
||||
\end{figure}
|
||||
|
||||
|
|
@ -539,8 +541,8 @@ of Xilinx 7 Series FPGAs provides the same $\frac{1}{32}$ clock cycle resolution
|
|||
N/A&25&0.01&Various resistors\\\hline
|
||||
\multicolumn{2}{r}{}&\textbf{9.67}&\textbf{Total}
|
||||
\end{tabular}
|
||||
\caption{Cost breakdown of our prototype design. Prices are listed at order quantity 1000 to make prices more
|
||||
comparable between distributors.}
|
||||
\caption[Prototype design cost breakdown]{Cost breakdown of our prototype design. Prices are listed at order
|
||||
quantity 1000 to make prices more comparable between distributors.}
|
||||
\label{tab_bom}
|
||||
\end{table}
|
||||
|
||||
|
|
@ -648,10 +650,10 @@ turn-on knee of the sampling diodes.
|
|||
\end{subfigure}
|
||||
\end{center}
|
||||
\vspace*{-5mm}
|
||||
\caption{Spectrum measurements and reconstructed time domain edge shape of the stimulus pulse
|
||||
measured at the mesh interface for each of the four driver ICs, captured using a spectrum analyzer. Vertical
|
||||
scale shows arbitrary units. Spectrum plots include a $\frac{1}{f}$ reference curve indicating an ideal
|
||||
infinite-bandwidth square wave.}
|
||||
\caption[Sampling mesh monitor stimulus pulse spectrum measurements]{Spectrum measurements and reconstructed time
|
||||
domain edge shape of the stimulus pulse measured at the mesh interface for each of the four driver ICs, captured
|
||||
using a spectrum analyzer. Vertical scale shows arbitrary units. Spectrum plots include a $\frac{1}{f}$
|
||||
reference curve indicating an ideal infinite-bandwidth square wave.}
|
||||
\label{fig_spec_risetime}
|
||||
\end{figure}
|
||||
|
||||
|
|
@ -678,8 +680,9 @@ slower than the raw pulse rise time value alone would suggest.
|
|||
\begin{center}
|
||||
\includegraphics[width=\textwidth]{fig_edge_risetime.pdf}\vspace*{-7mm}
|
||||
\end{center}
|
||||
\caption{One edge of the stimulus pulse with no mesh connected measured by the board itself, using different
|
||||
amplifier ICs. For each IC, ten traces are shown. The vertical scale is in Volts at the sampling amplifier output.}
|
||||
\caption[Sampling mesh monitor pulse self-characterization]{One edge of the stimulus pulse with no mesh connected
|
||||
measured by the board itself, using different amplifier ICs. For each IC, ten traces are shown. The vertical
|
||||
scale is in Volts at the sampling amplifier output.}
|
||||
\label{fig_edge_risetime}
|
||||
\end{figure}
|
||||
|
||||
|
|
@ -717,10 +720,11 @@ slower than the raw pulse rise time value alone would suggest.
|
|||
\qty{2.25}{\volt\per\nano\second}
|
||||
\end{tabular}
|
||||
\end{center}
|
||||
\caption{Single-ended stimulus edge rise times for different amplifier ICs. The single-ended rise times of both
|
||||
positive and negative half of the differential pair have been averaged. External measurements are from Figure\
|
||||
\ref{fig_spec_risetime}, measuring the stimulus pulse at the mesh interface. $V_{pp}$ measurements are taken at the
|
||||
mesh interface. Effective slew rates are calculated from the external measurements and pulse $V{pp}$.}
|
||||
\caption[Single-ended stimulus edge rise times for different amplifier ICs]{Single-ended stimulus edge rise times
|
||||
for different amplifier ICs. The single-ended rise times of both positive and negative half of the differential
|
||||
pair have been averaged. External measurements are from Figure\ \ref{fig_spec_risetime}, measuring the stimulus
|
||||
pulse at the mesh interface. $V_{pp}$ measurements are taken at the mesh interface. Effective slew rates are
|
||||
calculated from the external measurements and pulse $V{pp}$.}
|
||||
\label{tab_edge_risetime}
|
||||
\end{table}
|
||||
|
||||
|
|
@ -807,8 +811,8 @@ lines here and for \partno{TDP0604} since the other amplifiers' output did not c
|
|||
\qty{26}{\nano\second}\\
|
||||
\end{tabular}
|
||||
\end{center}
|
||||
\caption{Specifications of mesh test specimens used in the experiments in this chapter. Approximate signal delays
|
||||
were calculated using wave velocity
|
||||
\caption[Mesh test specimen specifications]{Specifications of mesh test specimens used in the experiments in this
|
||||
chapter. Approximate signal delays were calculated using wave velocity
|
||||
$v=\frac{c}{\sqrt{\epsilon_r}}\approx\frac{c}{2}$~\cite{wheelerTransmissionLinePropertiesParallel1965} assuming
|
||||
$\epsilon_r\approx 4$~\cite{mumbyDielectricPropertiesFR41989} for the test specimens' \partno{FR-4} substrate.}
|
||||
\label{tab_mesh_spec}
|
||||
|
|
@ -844,9 +848,10 @@ switching.
|
|||
\includegraphics[width=.8\textwidth]{fig_mesh_length.pdf}
|
||||
\vspace*{-10mm}
|
||||
\end{center}
|
||||
\caption{TDR responses captured by the microcontroller's internal ADCs with each of four candidate pulse amplifier
|
||||
ICs and four test meshes. The shown time range covers the primary reflection of the stimulus pulse's falling
|
||||
edge. For clarity, only one channel of the differential response is shown.}
|
||||
\caption[Sampling mesh monitor time-domain responses versus mesh length and amplifier]{TDR responses captured by the
|
||||
microcontroller's internal ADCs with each of four candidate pulse amplifier ICs and four test meshes. The shown
|
||||
time range covers the primary reflection of the stimulus pulse's falling edge. For clarity, only one channel of
|
||||
the differential response is shown.}
|
||||
\label{fig_mesh_length}
|
||||
\end{figure}
|
||||
|
||||
|
|
@ -891,8 +896,8 @@ switching.
|
|||
$\qty{1.59d8}{\meter\per\second}$\\
|
||||
\end{tabular}
|
||||
\end{center}
|
||||
\caption{Speed of light and time offset calculated from delays read from the graphs in Figure\
|
||||
\ref{fig_mesh_length}. $c$ is the speed of light determined by linear fit.}
|
||||
\caption[Speed of light calculations]{Speed of light and time offset calculated from delays read from the graphs in
|
||||
Figure\ \ref{fig_mesh_length}. $c$ is the speed of light determined by linear fit.}
|
||||
\label{tab_speed_of_light}
|
||||
\end{table}
|
||||
|
||||
|
|
@ -992,8 +997,9 @@ indicates good performance of our design, and increases the detection efficiency
|
|||
\includegraphics[width=\textwidth]{fig_covar_short_across_traces_p0.4.pdf}
|
||||
\caption{Both traces shorted, p=\qty{0.4}{\milli\meter}. FNR 0.0\% at 0.1\% FPR, CER=0\%.}
|
||||
\end{subfigure}
|
||||
\caption{Similarity matrix of 10 intact and 10 modified meshes with two pitch sizes under two
|
||||
different attack scenarios: An interrupted trace, and both mesh traces shorted.}
|
||||
\caption[Similarity matrices of modified meshes under different attack scenarios]{Similarity matrix of 10 intact and
|
||||
10 modified meshes with two pitch sizes under two different attack scenarios: An interrupted trace, and both
|
||||
mesh traces shorted.}
|
||||
\label{fig_covar_basic_attacks}
|
||||
\end{figure}
|
||||
|
||||
|
|
@ -1006,8 +1012,8 @@ location of the reflected pulse edge, resulting in 0\% Crossover Error Rate.
|
|||
\begin{figure}
|
||||
\centering
|
||||
\includegraphics[width=0.33\textwidth,trim=0 5mm 0 5mm]{fig_covar_short_within_0.3.pdf}
|
||||
\caption{Similarity matrix of several mesh specimens that have one trace shorted to an
|
||||
adjacent location on the same trace. Classification FNR 23\% at 0.1\% FPR, CER=22\%.}
|
||||
\caption[Similarity matrix of shorted meshes]{Similarity matrix of several mesh specimens that have one trace
|
||||
shorted to an adjacent location on the same trace. Classification FNR 23\% at 0.1\% FPR, CER=22\%.}
|
||||
\label{fig_short_within}
|
||||
\end{figure}
|
||||
|
||||
|
|
@ -1116,9 +1122,10 @@ distribution shifts.
|
|||
\vspace*{2mm}
|
||||
\label{fig_drill_mod_shape_pic}
|
||||
\end{subfigure}
|
||||
\caption{The mesh response under a manipulation attack patching across a drill location for a
|
||||
\qty{300}{\micro\meter} drill, as captured by the microcontroller's ADCs. The mesh pitch is
|
||||
\qty{300}{\micro\meter}. B-spline smoothing was applied for readability.}
|
||||
\caption[Time-domain mesh response differences during manipulation attack]{The mesh response under a manipulation
|
||||
attack patching across a drill location for a \qty{300}{\micro\meter} drill, as captured by the
|
||||
microcontroller's ADCs. The mesh pitch is \qty{300}{\micro\meter}. B-spline smoothing was applied for
|
||||
readability.}
|
||||
\label{fig_drill_mod_shape}
|
||||
\end{figure}
|
||||
|
||||
|
|
@ -1148,8 +1155,8 @@ only benchmark a momentary snapshot after the patch was completed.
|
|||
\caption{\emph{maximum} classifier variant. FNR 51.1\% at 0.1\% FPR, CER=15\%.}
|
||||
\label{fig_patch_large_scale_minmax}
|
||||
\end{subfigure}
|
||||
\caption{Classification performance in a larger-scale experiment using 10 measurements each of
|
||||
7 samples with traces patched through micro-soldering.}
|
||||
\caption[Classification performance in a large-scale experiment]{Classification performance in a larger-scale
|
||||
experiment using 10 measurements each of 7 samples with traces patched through micro-soldering.}
|
||||
\label{fig_patch_large_scale}
|
||||
\end{figure}
|
||||
|
||||
|
|
@ -1202,8 +1209,8 @@ domain based on a temperature measurement.
|
|||
\begin{figure}
|
||||
\centering
|
||||
\includegraphics[width=1.0\textwidth]{fig_tempco_edited.pdf}
|
||||
\caption{The effect of heating on a time-domain trace. One of 12 channels shown. Gray: Raw data. Black: Relative
|
||||
difference between hot and cool cases.}
|
||||
\caption[The effect of heating on a time-domain trace]{The effect of heating on a time-domain trace. One of 12
|
||||
channels shown. Gray: Raw data. Black: Relative difference between hot and cool cases.}
|
||||
\label{fig_tempco_time}
|
||||
\end{figure}
|
||||
|
||||
|
|
@ -1221,9 +1228,9 @@ classification performance remaining approximately constant at 69.0\% FNR at 0.1
|
|||
% NOTE: not actually "tridelta" data, I'm just too lazy to rename these and fix up the notebook.
|
||||
\includegraphics[width=0.6\textwidth]{fig_covar_patch_repeat_tridelta_all_the_data_p0.3.pdf}
|
||||
\hspace*{2mm}
|
||||
\caption{Classifier similarity scores of measurements in different environments, 10
|
||||
measurements each. For scale, measurements from Figure~\ref{fig_patch_large_scale} are included on the
|
||||
bottom/right. FNR 69.0\% at 0.1\% FPR, CER=22\%.}~
|
||||
\caption[Classifier similarity scores of measurements in different environments]{Classifier similarity scores of
|
||||
measurements in different environments, 10 measurements each. For scale, measurements from
|
||||
Figure~\ref{fig_patch_large_scale} are included on the bottom/right. FNR 69.0\% at 0.1\% FPR, CER=22\%.}
|
||||
\label{fig_env_covar}
|
||||
\end{figure}
|
||||
|
||||
|
|
|
|||
|
|
@ -246,9 +246,9 @@ server cooling components~\cite{coroamaPossibleFutureTrends2025}.
|
|||
16 & Memory~\cite{kennedyDDR4DIMMsSystem2017} &\qty{2}{\watt}&\qty{32}{\watt}\\
|
||||
1 & Losses & \qty{40}{\watt}&\qty{40}{\watt}\\
|
||||
\end{tabular}
|
||||
\caption{Power budget of a modern mid-range server. Losses were estimated at 10\%, consistent with mainboard losses
|
||||
plus losses from a 80plus platinum efficiency certified power supply (~94\% at load).
|
||||
}
|
||||
\caption[Power budget of a modern mid-range server.]{Power budget of a modern mid-range server. Losses were
|
||||
estimated at 10\%, consistent with mainboard losses plus losses from a 80plus platinum efficiency certified
|
||||
power supply (~94\% at load).}
|
||||
\label{tab_power_budget}
|
||||
\end{table}
|
||||
|
||||
|
|
|
|||
6
main.bib
6
main.bib
|
|
@ -2061,6 +2061,12 @@
|
|||
urldate = {2025-09-30}
|
||||
}
|
||||
|
||||
@online{FunLCDsVisual,
|
||||
title = {Fun with {{LCDs}} and {{Visual Cryptography}}},
|
||||
url = {https://justi.cz/security/2020/07/30/lcd-crypto.html},
|
||||
urldate = {2025-11-18}
|
||||
}
|
||||
|
||||
@article{ganjiHighPerformancePlanar2017,
|
||||
title = {High Performance Planar Micro-Transformer Using Novel Crossover Connection},
|
||||
author = {Ganji, Bahram Azizollah and Molanzadeh, Mohammad},
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue