diff --git a/chapter-hsms/chapter.tex b/chapter-hsms/chapter.tex index abd43c4..a784994 100644 --- a/chapter-hsms/chapter.tex +++ b/chapter-hsms/chapter.tex @@ -324,46 +324,6 @@ Figure~\ref{fig_hsm_survey_sample_internal_pics}. \label{fig_hsm_survey_sample_pics} \end{figure} -\begin{figure} - \begin{tabular}[c]{cccc} - \surveypic{01}{survey_internal_09_S01.jpg}& - \surveypic{02}{survey_internal_20_S02.jpg}& - \surveypic{03}{survey_internal_11_S03.jpg}& - \surveypic{04}{survey_internal_03_S04.jpg}\\ - \surveypic{05}{survey_internal_10_S05.jpg}& - \surveypic{06}{survey_internal_08_S06.jpg}& - \surveypic{08}{survey_internal_24_S08.jpg}& - \surveypic{09}{survey_internal_13_S09.jpg}\\ - \surveypic{10}{survey_internal_23_S10.jpg}& - \surveypic{11}{survey_internal_17_S11.jpg}& - \surveypic{12}{survey_internal_19_S12.jpg}& - \surveypic{13}{survey_internal_02_S13.jpg}\\ - \surveypic{14}{survey_internal_00_S14.jpg}& - \surveypic{14}{survey_internal_01_S14.jpg}& - \surveypic{15}{survey_internal_04_S15.jpg}& - \surveypic{16}{survey_internal_05_S16.jpg}\\ - \surveypic{17}{survey_internal_22_S17.jpg}& - \surveypic{18}{survey_internal_21_S18.jpg}& - \surveypic{19}{survey_internal_26_S19.jpg}& - \surveypic{20}{survey_internal_12_S20.jpg}\\ - \surveypic{21}{survey_internal_15_S21.jpg}& - \surveypic{22}{survey_internal_16_S22.jpg}& - \surveypic{23}{survey_internal_07_S23.jpg}& - \surveypic{24}{survey_internal_06_S24.jpg}\\ - \surveypic{25}{survey_internal_25_S25.jpg}& - \surveypic{27}{survey_internal_18_S27.jpg}& - \surveypic{28}{survey_internal_14_S28.jpg}& - \surveypic{30}{survey_internal_29_S30.jpg}\\ - \surveypic{31}{survey_internal_27_S31.jpg}& - \surveypic{32}{survey_internal_28_S32.jpg}& - % make sure the last row with a single dangling landscape picture is full height to avoid the last row's label - % overlapping the previous row - \rule{0pt}{25mm} - \end{tabular} - \caption{Internal overview photos of the survey samples} - \label{fig_hsm_survey_sample_internal_pics} -\end{figure} - \subsubsection{Card Payment Terminals} Card payment terminals commonly include advanced tamper sensing features to discourage physical attacks such as @@ -430,18 +390,72 @@ cases. Sometimes, tamper-sensing meshes show up in other types of devices. We acquired two such devices. First, we acquired a Neopost mail franking machine, a type of device that is used to directly print a code on an envelope that replaces a -conventional postage stamp. +conventional postage stamp. Since in businesses handling large volumes of mail these devices were routinely charged with large sums of +money in postage, such devices have security features ranging from physical seals on their enclosure to full security +meshes encasing their CPU modules. In case of Neopost, we are aware of one online source showing a security mesh inside +one such device~\cite{mikeselectricstuffNeopostPostalFranking2023}, but we found that our older specimen only contained +a sturdy cast zinc case that was welded shut with a spring-loaded lid switch inside. The other miscellaneous device we +found is a broken CPU module from a German slot machine manufacturer. While it would be reasonable to assume this type +of device might include active tamper sensing features to enforce state gambling regulations, other slot machine +manufacturers seem not to use tamper sensing in their systems so the more likely reason is DRM. Our specimen included +both a tamper-sensing mesh as well as a semiconductor junction light sensor inside of a sealed sheet metal enclosure. \subsection{Methodology} We proceeded by first photographing every test specimen from multiple angles, then disassembling them. After -disassembly, we photographed each major component. After photos were taken, we proceeded with destructive techniques -where necessary to obtain microscope photos of each tamper-sensing mesh component. PCBs were sectioned using a sanding -drum attachment on a Dremel rotary tool. Potted modules were disassembled using milling, cutting and prying, applying -heat from a heat gun as necessary to soften polymer compounds and to break glue joints. +disassembly, we photographed each major component. Figure~\ref{fig_hsm_survey_sample_internal_pics} shows a selection of +these photos showing the major internal components of the devices. After photos were taken, we proceeded with +destructive techniques where necessary to obtain microscope photos of each tamper-sensing mesh component. PCBs were +sectioned using a sanding drum attachment on a Dremel rotary tool. Potted modules were disassembled using milling, +cutting and prying, and applying heat from a heat gun as necessary to soften polymer compounds and to break glue joints. + +\begin{figure} + \begin{tabular}[c]{cccc} + \surveypic{01}{survey_internal_09_S01.jpg}& + \surveypic{02}{survey_internal_20_S02.jpg}& + \surveypic{03}{survey_internal_11_S03.jpg}& + \surveypic{04}{survey_internal_03_S04.jpg}\\ + \surveypic{05}{survey_internal_10_S05.jpg}& + \surveypic{06}{survey_internal_08_S06.jpg}& + \surveypic{08}{survey_internal_24_S08.jpg}& + \surveypic{09}{survey_internal_13_S09.jpg}\\ + \surveypic{10}{survey_internal_23_S10.jpg}& + \surveypic{11}{survey_internal_17_S11.jpg}& + \surveypic{12}{survey_internal_19_S12.jpg}& + \surveypic{13}{survey_internal_02_S13.jpg}\\ + \surveypic{14}{survey_internal_00_S14.jpg}& + \surveypic{14}{survey_internal_01_S14.jpg}& + \surveypic{15}{survey_internal_04_S15.jpg}& + \surveypic{16}{survey_internal_05_S16.jpg}\\ + \surveypic{17}{survey_internal_22_S17.jpg}& + \surveypic{18}{survey_internal_21_S18.jpg}& + \surveypic{19}{survey_internal_26_S19.jpg}& + \surveypic{20}{survey_internal_12_S20.jpg}\\ + \surveypic{21}{survey_internal_15_S21.jpg}& + \surveypic{22}{survey_internal_16_S22.jpg}& + \surveypic{23}{survey_internal_07_S23.jpg}& + \surveypic{24}{survey_internal_06_S24.jpg}\\ + \surveypic{25}{survey_internal_25_S25.jpg}& + \surveypic{27}{survey_internal_18_S27.jpg}& + \surveypic{28}{survey_internal_14_S28.jpg}& + \surveypic{30}{survey_internal_29_S30.jpg}\\ + \surveypic{31}{survey_internal_27_S31.jpg}& + \surveypic{32}{survey_internal_28_S32.jpg}& + % make sure the last row with a single dangling landscape picture is full height to avoid the last row's label + % overlapping the previous row + \rule{0pt}{25mm} + \end{tabular} + \caption{Internal overview photos of the survey samples} + \label{fig_hsm_survey_sample_internal_pics} +\end{figure} \subsection{Results} +In the following sections, we will list some observations we made while dissecting our specimens. A complete set of +internal pictures and micrographs of selected components that goes beyond the following description is available in the +supplementary material to this thesis. +\todo{Actually assemble the supplementary material and include all photos} + \subsubsection{Mesh materials.} We found meshes constructed from rigid PCBs as well as a number of Flexible Printed Circuit (FPC) processes. Tamper-sensing meshes constructed from PCBs sometimes used parts of an existing PCB, and sometimes additional PCBs only diff --git a/main.bib b/main.bib index ec4d5f6..e70a6f8 100644 --- a/main.bib +++ b/main.bib @@ -1510,7 +1510,8 @@ date = {2025-04}, url = {https://www.borderstep.de/wp-content/uploads/2025/06/EDNA-EE-of-servers-FINAL.pdf}, langid = {english}, - organization = {International Energy Agency} + organization = {International Energy Agency}, + file = {/home/jaseg/Zotero/storage/IN6J87WC/Coroamă et al. - Past and Possible Future Trends.pdf} } @incollection{couteauSilverSilentVOLE2021, @@ -2451,6 +2452,13 @@ file = {/home/jaseg/Sync/Research/Zotero/2022_Götte_Scheuermann_Can’t Touch This.pdf} } +@online{Goutimacocom84813320240417, + title = {Go.Utimaco.Com/l/848133/2024-04-17/3ld3sv/848133/{{1713340754fcnmfM7d}}/u.trust\_{{GP}}\_{{HSM}}\_{{Se}}\_{{Series}}\_{{Datasheet}}\_{{EN}}.Pdf}, + url = {https://go.utimaco.com/l/848133/2024-04-17/3ld3sv/848133/1713340754fcnmfM7d/u.trust_GP_HSM_Se_Series_Datasheet_EN.pdf}, + urldate = {2025-10-27}, + file = {/home/jaseg/Zotero/storage/FZ7VSMEV/u.trust_GP_HSM_Se_Series_Datasheet_EN.html} +} + @online{greenbergSignalMoreEncrypted2024, title = {Signal {{Is More Than Encrypted Messaging}}. {{Under Meredith Whittaker}}, {{It}}’s {{Out}} to {{Prove Surveillance Capitalism Wrong}}}, author = {Greenberg, Andy}, @@ -3455,7 +3463,8 @@ urldate = {2025-10-27}, abstract = {We tested a low power 1U system with 16x and 4x DDR4 DIMMs to see the power consumption impact of using fewer RDIMMs in a server}, langid = {american}, - organization = {ServeTheHome} + organization = {ServeTheHome}, + file = {/home/jaseg/Zotero/storage/2FADBUGE/ddr4-dimms-system-power-consumption-tested.html} } @online{KiCadEDA, @@ -3793,6 +3802,17 @@ file = {/home/jaseg/Sync/Research/Zotero/2012_Kryjak et al_FPGA implementation of camera tamper detection in real-time.pdf} } +@misc{kumarIBMZ16Performance2025, + title = {{{IBM}} Z16 {{Performance}} of {{Cryptographic Operations}}: {{Cryptographic Hardware}}: {{CPACF}}, {{CEX8S}} with {{Quantum-Safe CRYSTALS}} Algorithms}, + author = {Kumar, Dinesh}, + date = {2025-03}, + url = {https://www.ibm.com/docs/en/cryptocards?topic=4770-performance}, + urldate = {2025-10-27}, + langid = {english}, + organization = {IBM}, + file = {/home/jaseg/Zotero/storage/NNWPQWCX/Kumar - (Cryptographic Hardware CPACF, CEX8S with Quantum.pdf} +} + @article{kvk2019, title = {Internet of Things Based Monitoring of Large Rotor Vibration with a Microelectromechanical Systems Accelerometer}, author = {Koene, Ivar and Viitala, Raine and Kuosmanen, Petri}, @@ -5772,13 +5792,6 @@ file = {/home/jaseg/Zotero/storage/BHBDVJAI/ki_empfehlung_kurz.en.pdf} } -@online{RecommendationsUniversityState2025, - title = {Recommendations of the {{University}} and {{State Library Darmstadt}} for {{Labelling}} and {{Documenting AI-generated Content}}}, - date = {2025-09-22}, - url = {https://www.ulb.tu-darmstadt.de/ki-doku}, - urldate = {2025-10-24} -} - @online{RefusingTechFascism, title = {Refusing {{Tech Fascism}} — {{Error}} 406 {{Tech Fascism Not Acceptable}}}, url = {https://error417.expectation.fail/406/tech-fascism-not-acceptable/essay-refusing-tech-fascism-by-tante}, @@ -6896,7 +6909,8 @@ Archive 2: https://web.archive.org/web/20250510104017/https://de.linkedin.com/pu date = {2024-10}, url = {https://cpl.thalesgroup.com/sites/default/files/content/product_briefs/luna-sa-network-attached-hsm-pb.pdf}, urldate = {2025-10-27}, - organization = {Thales} + organization = {Thales}, + file = {/home/jaseg/Zotero/storage/62IF4C9R/luna-sa-network-attached-hsm-pb.pdf} } @article{tobisch2020, @@ -6974,7 +6988,8 @@ Archive 2: https://web.archive.org/web/20250510104017/https://de.linkedin.com/pu urldate = {2025-10-27}, abstract = {The SPEC Power benchmark offers valuable insights into the energy efficiency of server systems, allowing comparisons across various hardware and software configurations. Benchmark results are publicly available for hundreds of systems from different vendors, published since 2007. We leverage this data to perform an analysis of trends in x86 server systems, focusing on power consumption, energy efficiency, energy proportionality and idle power consumption. Through this analysis, we aim to provide a clearer understanding of how server energy efficiency has evolved and the factors influencing these changes.}, eventtitle = {2024 {{IEEE International Conference}} on {{Cluster Computing Workshops}} ({{CLUSTER Workshops}})}, - keywords = {Benchmark testing,Computer architecture,Computer performance,Conferences,Energy efficiency,Focusing,Hardware,High performance computing,Market research,Performance analysis,Power demand,Processor energy efficiency,Servers,Software} + keywords = {Benchmark testing,Computer architecture,Computer performance,Conferences,Energy efficiency,Focusing,Hardware,High performance computing,Market research,Performance analysis,Power demand,Processor energy efficiency,Servers,Software}, + file = {/home/jaseg/Zotero/storage/T82VHY3I/10740865.html} } @online{tschirsichHackerHinOder0100, @@ -7067,6 +7082,15 @@ Archive 2: https://web.archive.org/web/20250510104017/https://de.linkedin.com/pu file = {/home/jaseg/Sync/Research/Zotero/2019_Technology_Security Requirements for Cryptographic Modules.pdf} } +@misc{Utrust_GP_HSM_Se_Series_Datasheet_ENpdf, + title = {U.Trust {{General Purpose HSM Se-Series Datasheet}}}, + date = {2025-04}, + url = {https://utimaco.com/resources/downloads/data-sheets/utrust-general-purpose-hsm-se-series-datasheet}, + urldate = {2025-10-27}, + organization = {utimaco}, + file = {/home/jaseg/Zotero/storage/FV32WI5N/u.trust_GP_HSM_Se_Series_Datasheet_EN.pdf} +} + @inproceedings{uzunCryptographicKeyDerivation2021, title = {Cryptographic {{Key Derivation}} from {{Biometric Inferences}} for {{Remote Authentication}}}, booktitle = {Proceedings of the 2021 {{ACM Asia Conference}} on {{Computer}} and {{Communications Security}}}, @@ -8136,7 +8160,8 @@ Archive 2: https://web.archive.org/web/20250510104017/https://de.linkedin.com/pu abstract = {Litz wire planar spiral coils are widely used in inductive power transfer systems due to low power loss in high-frequency operation and low profile. However, the complicated structure of the litz wire coil imposes difficulties in estimating the frequency-dependent resistance and quality factor accurately. In this work, we present an 2D analytical model for calculating the frequency-dependent resistance and quality factor of multi-coil inductive power transfer systems based on superposition of different loss effects. Its accuracy is validated with multiple coils and litz wires over wide frequency range. Meanwhile, a fast and accurate multi-objective optimization method is developed to improve the product quality factor and coupling factor. From the optimization results, there are five factors affecting the quality factor and coupling factor. A set of design guidelines is proposed to cope with these design factors. The final prototypes show 33\textbackslash\% increase in quality factor and 23\textbackslash\% improvement in coupling factor compared with the state-of-the-art designs. Meanwhile, a 30W, 500kHz inductive power transfer system is designed with 91\textbackslash\% peak efficiency.}, langid = {english}, pubstate = {prepublished}, - keywords = {preprint} + keywords = {preprint}, + file = {/home/jaseg/Zotero/storage/ZAQTS252/Zhao et al. - 2023 - Design and Optimization of Litz-Wire Planar Spiral.pdf} } @article{zhouHiddenVoiceCommands2019,