1354 lines
89 KiB
TeX
1354 lines
89 KiB
TeX
%\chapterquote{Attributed to Tom Milligan~\cite{peaseTroubleshootingAnalogCircuits1993}}{When you are taking data, if you see something funny, Record Amount of Funny.}
|
|
\chapterquote{Stewart Brand~\cite{internetarchiveWholeEarthCatalog1969}}{We are as gods and might as well get good at
|
|
it.}
|
|
\chaptertitle{High Fidelity Security Mesh Monitoring using Low-Cost, Embedded Time Domain Reflectometry}
|
|
\label{chapter_sampling_mesh_mon}
|
|
|
|
\section{Introduction}
|
|
|
|
\sourceattrib{This chapter is adapted from a paper written by me that will be presented by me at CHES
|
|
2026~\cite{gotteHighFidelitySecurity2026}.}
|
|
Security meshes continue to be the state of the art for tamper sensing in applications where sophisticated physical
|
|
attacks such as attempts at drilling or sawing through the device's enclosure to place probes must be prevented. Common
|
|
applications for such meshes include Hardware Security Modules (HSMs) used to store and process cryptographic keys
|
|
applying security standards such as
|
|
FIPS-140-2~\cite{usnationalinstituteofstandardsandtechnologySecurityRequirementsCryptographic2002} or ISO/IEC
|
|
24759~\cite{ISOIEC24759}. Other applications include card payment terminals where PCI PTS HSM
|
|
standards~\cite{pcisecuritystandardscouncilPaymentCardIndustry2021} are applicable. Security meshes usually consist of
|
|
two or more conductive traces that are laid out in a meandering pattern to cover a surface. A sensing circuit
|
|
electrically monitors these traces to detect attempts at penetrating this surface.
|
|
|
|
As is often the case with security technologies, in practice a tension exists between the level of security offered by a
|
|
particular security mesh implementation and its implementation cost. Commercial designs often only coarsely monitor the
|
|
conductivity of the mesh traces and are incapable of detecting attacks that manipulate small parts of the mesh. The most
|
|
secure meshes are made in custom manufacturing processes. Materials such as polymer substrates are specifically chosen
|
|
such that the mesh is difficult to manipulate without breaking it. A drawback of this approach is that the specialized
|
|
manufacturing processes are difficult to replicate and that the resulting cost of the mesh is high. In some
|
|
lower-security applications such as card payment terminals, simpler approaches are still commonly used for their ease of
|
|
implementation. Often, standard copper/polyimide Flexible Printed Circuits (FPCs) or even standard Printed Circuit
|
|
Boards (PCBs) are used because of the wide availability of manufacturing services.
|
|
\todo{Integrate new scope plots!}
|
|
|
|
Inertial HSMs are one approach that enables the use of less expensive, commodity materials in high-security
|
|
applications. Several other academic approaches exist that target low-cost~\cite{
|
|
vasileActiveTamperDetection2017,
|
|
vasileTemperatureSensitiveActive2017,
|
|
dupontMiniaturizedUltraLowPowerTamper2022,
|
|
vasileProtectingSecretsAdvanced2019,
|
|
} or high-performance mesh monitoring~\cite{
|
|
immlerBTREPIDBatterylessTamperresistant2018,
|
|
immlerSecurePhysicalEnclosures2018,
|
|
garbTamperSensitiveDesignPUFBased,
|
|
}. Some academic works even try to replace the security mesh with entirely different tamper sensing primitives~\cite{
|
|
staatAntiTamperRadioSystemLevel2022,
|
|
vaiSecureArchitectureEmbedded2015,}.
|
|
High-performance mesh monitoring approaches try to characterize the mesh's physical properties with high accuracy, but
|
|
often come at the cost of specialized, expensive circuitry. Low-cost approaches utilize advanced analog techniques in
|
|
their circuitry to extract precise measurements using few components. They trade off measurement precision for lower
|
|
component cost. Besides simple monitoring, detecting tamper attempts by replacing the mesh with a macro-scale Physical
|
|
Unclonable Function (PUF) has also been researched~\cite{
|
|
immlerBTREPIDBatterylessTamperresistant2018,
|
|
staatAntiTamperRadioSystemLevel2022,
|
|
vaiSecureArchitectureEmbedded2015,}, albeit this comes with complex monitoring circuits that utilize expensive,
|
|
specialty components.
|
|
|
|
\begin{figure}
|
|
\centering
|
|
\includegraphics[width=0.6\textwidth]{pic_board_setup_2_small.jpg}
|
|
\caption[Sampling mesh monitor prototype and test coupon]{Measurement setup. Shown are the test specimen board on
|
|
the left, and the frontend board with one of the four pulse amplifiers in the center. The frontend board is
|
|
powered through a USB-C connection, and data is sent to a computer through a Single-Wire Debug (SWD) interface.
|
|
The grid in the background has \qty{10}{\milli\meter} pitch.}
|
|
\label{fig_pic_board}
|
|
\end{figure}
|
|
|
|
To enable the use of less expensive, commodity materials such as Printed Circuit Boards (PCBs) without compromising
|
|
security, mesh integrity must be monitored with high fidelity. In this chapter, we present a low-cost monitoring circuit
|
|
for security meshes that combines Time Domain Reflectometry (TDR) with equivalent time sampling. Our approach provides
|
|
high measurement fidelity and enables the use of meshes made from less expensive materials in high-security
|
|
applications. Our design directly applies to IHSM implementations, and complements the security offered by the IHSM's
|
|
mechanical motion.
|
|
|
|
Our circuit generates a very fast pulse with a rise time lower than \qty{200}{\pico\second} that is broadcast into the
|
|
mesh. While the pulse traverses the mesh, parts of its energy are reflected on imperfections inside the mesh, including
|
|
those caused by tampering attempts. Our circuit uses a fast, low-cost equivalent time sampling frontend to receive,
|
|
amplify and record these reflections to create a \emph{fingerprint} of the mesh that is highly sensitive to changes
|
|
caused by tampering.
|
|
|
|
We demonstrate a working prototype of our design and present practical measurements of its electrical parameters as well
|
|
as its performance under several practical attack scenarios. A photo of our prototype setup including a security mesh
|
|
specimen is shown in Figure\ \ref{fig_pic_board}.
|
|
|
|
Compared to previous academic designs, our approach can be implemented at a lower cost using exclusively inexpensive,
|
|
commercially available mass-market components. Our TDR frontend improves upon previous, delay-based approaches in
|
|
monitoring fidelity~\cite{vasileActiveTamperDetection2017,vasileTemperatureSensitiveActive2017}. Our design achieves
|
|
sufficient sensitivity to detect high-impedance oscilloscope probes despite such probes being specifically designed to
|
|
conduct measurements without disturbing the circuit under test. Unlike previous, capacitance-based approaches, our
|
|
design is compatible with inexpensive signal switch ICs, enabling the protection of arbitrarily large meshes at minimal
|
|
cost without compromising sensitivity.
|
|
|
|
The contributions of our work are as follows:
|
|
|
|
\begin{itemize}
|
|
\item To our knowledge, our design is the first to apply a low-cost embedded differential Time Domain Reflectometry
|
|
(TDR) frontend to security mesh monitoring. Our design achieves pulse rise times below \qty{200}{\pico\second},
|
|
a $25\times$ improvement over the closest previous
|
|
work~\cite{vasileActiveTamperDetection2017,vasileTemperatureSensitiveActive2017}.
|
|
\item Our approach provides higher fidelity compared to state-of-the-art security mesh conductivity monitoring or
|
|
previous low-cost approaches. It enables the use of meshes manufactured using less advanced technologies such as
|
|
standard FPC or PCB processes. Our TDR frontend produces 70 data points for each meter of mesh length, resulting
|
|
in a measurement density per mesh area of \qty{200}{\bit\per\centi\meter^2} when using a
|
|
$\qty{200}{\micro\meter}$ pitch mesh manufactured in a standard low-cost PCB process.
|
|
\item We present a working prototype along with extensive experimental results, including laboratory performance
|
|
measurements. We practically demonstrate that our design is able to not only detect but distinguish and even
|
|
localize attacks in several realistic attack scenarios.
|
|
\item Our design is based entirely on commercially available, inexpensive mass-market components. It can be
|
|
replicated and improved without access to bespoke production equipment or semiconductor manufacturing
|
|
capabilities. To facilitate further research and practical applications, we publish our prototype under an Open
|
|
Source license.
|
|
\end{itemize}
|
|
|
|
\section{Related Work}
|
|
\label{sec_sampling_mesh_mon_related_work}
|
|
|
|
Tamper sensing meshes are used in numerous applications from Hardware Security Modules (HSMs) to card payment
|
|
terminals~\cite{andersonCryptographicProcessorsASurvey2006,tehranipoorHardwareSecurityPrimitives2023}. Despite their
|
|
widespread use, security mesh design and monitoring is covered by a sparse research corpus. Commercially,
|
|
security-by-obscurity is often considered a good idea and little detail is published on physical security
|
|
implementations~\cite{andersonSecurityEngineeringGuide2020}.
|
|
|
|
Patent literature gives a partial view of commercial developments in this area. Even in recent patents such as~\cite{
|
|
brodskyTamperRespondentAssemblyFlexible2019, % IBM. ok, mentions conductivity monitoring but mostly on mesh
|
|
nortonTamperDetectingCases2019, % HP. ok, mentions continuity monitoring only but mostly on mesh
|
|
razaghiTamperDetectionSystem2020, % Square. ok. mentions what is effectively conductivity monitoring
|
|
wesselhoffTamperResponsiveSensor2020, % Cryptera. ok. Very basic, only uses the mesh in the power supply.
|
|
leekTamperDetection2021, % Texas Instruments. ok. Monitors capacitance.
|
|
chockPointSaleTerminal2009, % Zilog. ok. Monitors conductivity and tries to detect emulation.
|
|
}
|
|
from HSM manufacturers IBM and HP, ATM component manufacturer Cryptera, payment terminal manufacturer Stripe, and chip
|
|
manufacturers Texas Instruments and Zilog, cited monitoring methods are basic and do not go beyond a simple measurement
|
|
of resistance or capacitance.
|
|
|
|
Academic research in the area is more advanced and spans both improvements to security meshes and their monitoring
|
|
circuits~\cite{
|
|
immlerBTREPIDBatterylessTamperresistant2018,
|
|
dupontMiniaturizedUltraLowPowerTamper2022,
|
|
vasileProtectingSecretsAdvanced2019},
|
|
as well as approaches that entirely replace the security mesh with other primitives based on e.g.\ radio frequency or
|
|
optical measurements that aim to sense tampering
|
|
with a device~\cite{staatAntiTamperRadioSystemLevel2022,vaiSecureArchitectureEmbedded2015}. A drawback of techniques
|
|
aiming to replace security meshes with other sensor types is that it is difficult to prove such sensors do not have
|
|
blind spots.
|
|
|
|
\subsection{Security Mesh Monitoring and Design}
|
|
|
|
\paragraph{Meshes as capacitive PUFs.}
|
|
\textcite{
|
|
immlerBTREPIDBatterylessTamperresistant2018,
|
|
obermaierMeasurementSystemCapacitive2018,
|
|
garbTamperSensitiveDesignPUFBased}
|
|
propose one of the most advanced security mesh designs in the current academic state of the art. They use a specialized
|
|
security mesh as a Physical Unclonable Function (PUF), combining tamper sensing with cryptographic key storage. In their
|
|
design, the mesh consists of a cross-hatch pattern made from several dozen individually addressable capacitive
|
|
electrodes. They manufacture their meshes in a specialized process that results in unpredictable, random variations in
|
|
capacitance between electrodes. They propose an analog frontend that measures the precise mutual capacitance of each
|
|
pair of electrodes~\cite{obermaierMeasurementSystemCapacitive2018} using an approach similar to
|
|
\textcite{satoToucheEnhancingTouch2012}, and they use the resulting capacitance matrix as the basis of their PUF. In
|
|
further work, they demonstrate a custom IC integrating the monitoring
|
|
circuit~\cite{garbFORTRESSFORtifiedTamperResistant2021}.
|
|
|
|
Advantages of their system include high sensitivity to modifications, as well as that as a PUF, the system does not
|
|
require a continuous power supply. Disadvantages include the limited mesh size a single circuit can support due to
|
|
dynamic range constraints, the specialized manufacturing process needed for the mesh as well as the high cost of the
|
|
monitoring circuit. Common physical security standards require systems to actively destroy all key material when
|
|
tampering is detected~\cite{
|
|
usnationalinstituteofstandardsandtechnologySecurityRequirementsCryptographic2002,
|
|
ISOIEC24759,
|
|
pcisecuritystandardscouncilPaymentCardIndustry2021}.
|
|
Like other PUF-based systems, their system naturally lacks this capability.
|
|
~
|
|
Key differences of our system include:
|
|
\begin{itemize}
|
|
\item Our system can cover larger meshes without loss of precision using a single TDR frontend through multiplexing.
|
|
|
|
\item Our system supports meshes manufactured using standard, low-cost PCB processes.
|
|
|
|
\item Our design requires only widely available, low-cost commodity components, for each of which alternatives
|
|
from other manufacturers are available.
|
|
|
|
\item Our approach has improved resiliency to electromagnetic interference and works with unshielded meshes.
|
|
\end{itemize}
|
|
|
|
\paragraph{Bridge measurement of capacitive interdigital meshes.} \textcite{dupontMiniaturizedUltraLowPowerTamper2022}
|
|
introduce a simple analog circuit approach for monitoring meshes laid out as a set of capacitive interdigital structures
|
|
not unlike the combs found in Micro-Electromechanical System (MEMS) accelerometers and gyroscopes. They subdivide the
|
|
mesh into four equal-size quadrants, each containing two equal-size interdigital electrodes. They connect the resulting
|
|
eight electrodes in a capacitive bridge configuration and measure the bridge's balance using a simple analog monitoring
|
|
circuit based on homodyne detection. Advantages of their system include the simple, low-power monitoring circuit made
|
|
from basic, cheap components and the capability to work with single-layer meshes such as those produced using Laser
|
|
Direct Structuring (LDS). From a security point of view, a drawback of their approach is that to achieve its low-power
|
|
usage, measurement resolution is sacrificed and all information on the mesh's state is collapsed into a single, scalar
|
|
measurement.
|
|
|
|
\paragraph{Frequency-domain mesh characterization.}
|
|
\textcite{vasileProtectingSecretsAdvanced2019} introduce a monitoring method where they feed a variable-frequency signal
|
|
into one end of a continuous mesh trace, and measure the power of the signal coming out of the other end. In essence,
|
|
their setup measures $S_{12}$ magnitude in a similar way to a network analyzer.
|
|
|
|
Advantages of their design include the simple implementation and the potentially robust nature of frequency-domain
|
|
measurements. Disadvantages include a nonstandard three-layer mesh stackup, as well as the susceptibility of the system
|
|
to attack by emulation given that the log power sensor they are using at the mesh output is designed to be insensitive
|
|
to any signal characteristics apart from total signal power.
|
|
|
|
\paragraph{Time domain mesh monitoring.}
|
|
Time-Domain Reflectometry has been proposed for tamper sensing in nuclear arms control
|
|
applications~\cite{parsonsTamperRadiationResistant1977}. However, compared to our design, the systems proposed in this
|
|
field are usually much larger, using standard benchtop measurement equipment to perform TDR. Additionally, they target
|
|
lower time resolution since they are designed to monitor spans of cable up to several hundred meters in length.
|
|
|
|
Closest to our proposal in the academic corpus is the work of
|
|
\textcite{vasileActiveTamperDetection2017,vasileTemperatureSensitiveActive2017}, where they propose monitoring the time
|
|
domain response of a mesh using a circuit made from a pulse generator and a fast Analog-to-Digital Converter (ADC). To
|
|
avoid an expensive, high-speed digital processing pipeline, their design is centered around a specialized high-speed ADC
|
|
that has a built-in sample memory. Using this part, they capture a pulse at high speed after it traverses the mesh.
|
|
Subsequently, they slowly process the captured data from memory. A 2007
|
|
patent~\cite{matsunoProtectionCircuitSemiconductor2008} proposes the same delay-based approach.
|
|
|
|
Advantages of their design include better sensitivity to changes in total mesh trace length compared to simple
|
|
continuity monitoring and the low complexity of their analog frontend. Disadvantages include the reliance on a specialty
|
|
ADC that cannot easily be replaced with any other commercially available component and the coarse time resolution.
|
|
|
|
Key differences between their design and our proposal include:
|
|
\begin{itemize}
|
|
\item Their design is sensitive to total length, but not to the location of faults. Their design measures the mesh's
|
|
\emph{transmission} characteristic, which collapses detail about faults along the mesh into a small number of
|
|
ADC samples at the pulse edge. Using such a measurement, it is not possible to localize faults. In contrast, our
|
|
approach measures the signal's \emph{reflected} component, which spreads information over time and enables us to
|
|
localize faults.
|
|
|
|
\item Our design uses only inexpensive, widely available parts. All parts in our design can easily be substituted
|
|
for other, similar parts from different manufacturers.
|
|
|
|
\item Our approach provides $25\times$ higher time resolution through Equivalent Time Sampling. This is a
|
|
fundamental limitation of their design, as the cost of ADCs and their associated circuitry increases steeply
|
|
with speed\footnote{ For reference, the least expensive ADC available at distributor DigiKey that would match
|
|
the \qty{200}{\pico\second} time resolution of our approach would cost \price{320}{\euro} at quantity 100 and
|
|
require national security clearance for export from its manufacturer in the USA.}.
|
|
\end{itemize}
|
|
|
|
\subsection{Equivalent Time Sampling}
|
|
|
|
Today, systems that digitize high-speed signals usually use a fast ADC, sometimes preceded by one or several
|
|
downconverting mixers. This development was enabled by both the increasing availability of ADCs capable of digitizing
|
|
hundreds of megasamples per second at a reasonable resolution, and by the increase in speed of CPUs,
|
|
FPGAs, and other components of the digital processing chain. However, this is largely a development of this
|
|
millennium--meanwhile, signals far into the gigahertz range have been studied since the advent of radar technology in
|
|
the Second World War~\cite{kahrs50YearsRF2003}. Enabled by the progress from vacuum tubes to semiconductor devices,
|
|
equivalent time sampling became the technology of choice for the latter half of the twentieth century until around the
|
|
turn of the millennium the introduction of high-speed digital processing and fast ADCs enabled real-time conversion up
|
|
into higher microwave frequencies, today reaching beyond the \qty{100}{\giga\hertz} boundary.
|
|
|
|
\textcite{kahrs50YearsRF2003} trace back the style of four-diode balanced bridge sampling gate that we use to a vacuum
|
|
tube implementation presented in \textcite{chanceWaveforms1949}. This style of sampling gate found application in a
|
|
number of sampling oscilloscopes throughout the twentieth century in several oscilloscope sampling frontends such as
|
|
HP's 187B~\cite{HP187BDualTrace1962}.
|
|
|
|
While initially equivalent time sampling was used to circumvent technological limitations, more recently it has also
|
|
been used to achieve cost-optimized designs~\cite{houtman1GHzSamplingOscilloscope2000}. Going along similar principles,
|
|
\textcite{polasekReflektometrCasoveOblasti2020} presents a design for a minimal sampling TDR circuit that uses a CMOS
|
|
clock generator IC along with a CML fanout buffer for pulse generation. The circuit improves upon the double sampling
|
|
design first presented by \textcite{houtman1GHzSamplingOscilloscope2000} to reconstruct a downsampled copy of the input
|
|
signal in the analog domain before digitization.
|
|
|
|
\subsection{Low-Cost Time Domain Reflectometry}
|
|
|
|
\textcite{bencivenniTimeDomainReflectometer2013} present an FPGA-based embedded reflectometer design. Since their design
|
|
is based on an early FPGA family dating back to 2003 that lacked the speed and the adjustable I/O delay features of more
|
|
modern FPGA families, their design uses the FPGA's logic resources to achieve adjustable delays.
|
|
\textcite{negreaSequentialSamplingTime2009} show an equivalent time sampling TDR that uses specialized adjustable delay
|
|
line ICs for pulse generation. \textcite{lee16psresolutionRandomEquivalent2003} achieve very high time resolution in an
|
|
equivalent time sampling TDR system by using a vernier approach to pulse generation, such that their system is limited
|
|
by analog bandwidth, not time resolution. \textcite{trebbelsMiniaturizedFPGABasedHighResolution2013} show another
|
|
FPGA-based TDR. Their system also uses a part from the same early FPGA family as
|
|
\textcite{bencivenniTimeDomainReflectometer2013}, and they work around its lack of precise timing primitives by
|
|
generating a low-frequency sine wave through DDS, which they filter, and then sample using a comparator - a similar
|
|
approach to the timing generation in \textcite{houtman1GHzSamplingOscilloscope2000}. Additionally, they avoid the need
|
|
for a discrete ADC by implementing a $\Delta\Sigma$ loop around a fast comparator, trading off slower acquisition time
|
|
for lower hardware complexity. They use a \qty{5.5}{\volt\per\nano\second} slew rate wideband amplifier IC to generate
|
|
their stimulus pulse, achieving a rise time of \qty{2}{\nano\second}. As a result, similar to
|
|
\textcite{lee16psresolutionRandomEquivalent2003}, their design is limited by analog bandwidth--here resulting from the
|
|
nanosecond-scale stimulus rise time--not by frontend time resolution. Compared with this and other previous approaches,
|
|
our proposed system is not only faster, but presents a more balanced trade-off between time resolution and analog
|
|
bandwidth.
|
|
|
|
\subsection{Device Fingerprinting through Impedance Sensing}
|
|
|
|
Recently, impedance analysis on the Power Distribution Network (PDN) of PCB assemblies has been proposed as a
|
|
fingerprinting technique aimed at detecting Hardware Trojans (HT) inserted into a board~\cite{
|
|
fujimotoDemonstrationHTDetectionMethod2018,
|
|
mosavirikImpedanceVerifOnChipImpedance2022}.
|
|
Usually, all chips on a board are directly connected to the board's PDN. Thus, characterizing the board's PDN does not
|
|
only yield information on possible modifications to the board's PDN itself---such as modified traces or removed passive
|
|
components---it also reflects information about the internal structure of chips connected to the PDN. Impedance analysis
|
|
techniques generally probe the circuit during operation using high-frequency signals. They have been proven using an
|
|
external Vector Network Analyzer in one-Port~\cite{mosavirikSiliconEchoesNonInvasive2023} configuration measuring
|
|
reflected signal components as well as using two or more ports measuring transmitted signal
|
|
components~\cite{zhuPDNPulseSensingPCB2023}. Both Time Domain
|
|
Reflectometry~\cite{fujimotoDemonstrationHTDetectionMethod2018} and conventional frequency-domain VNA
|
|
measurements~\cite{mosavirikImpedanceVerifOnChipImpedance2022} have been shown to be effective. From a signal theory
|
|
point of view, both techniques can be considered equivalent.
|
|
|
|
While using an external VNA is feasible for validation in a factory setting, several research works embed the measuring
|
|
system into the PCB as either a discrete circuit~\cite{fujimotoDemonstrationHTDetectionMethod2018} or as part of an FPGA
|
|
gateware~\cite{
|
|
mosavirikImpedanceVerifOnChipImpedance2022,
|
|
mosavirikBackMonICBackside2024}.
|
|
With such a system, boards can self-verify in the field after deployment, enabling the use of the system for active
|
|
tamper sensing. While at less than \qty{2}{\giga\hertz} the achievable bandwith of such systems is lower than that
|
|
provided by an external, research-grade VNA, it turns out that the frequencies of interest in the impedance profile of
|
|
practical boards lie inside of this small bandwidth~\cite{mosavirikImpedanceVerifOnChipImpedance2022}.
|
|
|
|
Variations of impedance analysis techniques have been demonstrated that detect changes inside individual chips using
|
|
board-level measurements~\cite{luCorrelatedRandomnessTeleportation2021}, that detect manipulatoins using non-contact
|
|
near-field Radio Frequency (RF) measurements~\cite{saadatsafaNearFieldMicrowaveSensing2025}, that detect the mechanical
|
|
preparation of a target chip for backside attacks using onboard measurements~\cite{mosavirikBackMonICBackside2024}, and
|
|
that adapt the technique as an offensive tool for side-channel analysis (SCA)
|
|
attacks~\cite{monfaredLeakyOhmSecretBits2023}.
|
|
|
|
Similar to PDN impedance analysis, our proposed technique also embeds a RF measurement circuit in a target board. TDR
|
|
and frequency-domain VNA measurements resolve the same information about a target circuit from a signal theory
|
|
perspective. Our system reaches a significantly higher bandwidth than embedded measurement setups from differs from PDN
|
|
impedance analysis literature, and that our proposed tamper-sensing meshes are specifically built as sensors. Our
|
|
technique is better suited to active tamper-sensing applications where the sensing circuit is continuously powered. In
|
|
contrast to PDN impedance analysis techniques that need the entire PDN to be powered, our proposed technique can be
|
|
applied to protect an unpowered payload circuit. In a practical application, both PDN impedance analysis and TDR-based
|
|
tamper-sensing meshes could complement each other to form a comprehensive defense where PDN impedance analysis checks
|
|
the core system's integrity, with TDR-based meshes covering everything outside the purview of PDN impedance analysis.
|
|
|
|
\section{Monitoring a Security Mesh using Time Domain Reflectometry}
|
|
|
|
Time Domain Reflectometry (TDR) is a well-known technique that is used to locate faults along a signal channel such as a
|
|
copper cable, or an optical fiber. In TDR, a pulse is sent into the beginning of the channel. While the pulse traverses
|
|
the channel, any fault such as a discontinuity in electrical impedance or optical density causes part of the pulse to
|
|
travel back in a partial reflection. TDR monitors these reflections returning to the beginning of the channel by
|
|
recording the signal measured at it after the pulse has been sent. When the pulse reaches the end of the channel,
|
|
depending on termination it can be reflected to travel back to the beginning, which allows measurement of the channel's
|
|
length.
|
|
|
|
\subsection{Attacks on a Security Mesh Viewed Using TDR}
|
|
|
|
In this chapter, we apply TDR to monitor a security mesh for changes caused by an attack. Our prototype setup consists
|
|
of a custom circuit board containing a low-cost embedded TDR frontend that can be connected to a security mesh specimen
|
|
to measure its response, creating a fingerprint of the mesh. In a standard PCB manufacturing process, we construct a
|
|
security mesh with a ground plane underneath that works similarly to previous work~\cite{
|
|
immlerBTREPIDBatterylessTamperresistant2018,
|
|
obermaierMeasurementSystemCapacitive2018,
|
|
garbTamperSensitiveDesignPUFBased}.
|
|
When viewed in the microwave domain, such meshes constitute what is essentially a delay line. Security meshes commonly
|
|
use a pair of two traces to capture short circuit conditions between adjacent traces, which we treat as a differential
|
|
pair for improved resiliency against electromagnetic interference. We constructed our frontend such that it excites the
|
|
two traces differentially, but allows for both single-ended and differential measurements.
|
|
|
|
In an intact mesh, we expect our frontend to record no significant reflections until the stimulus pulse has traversed
|
|
the mesh's traces both ways, at which point we expect a large response whose polarity and amplitude depend on the
|
|
termination on the far end of the mesh. In our prototype circuit, we made this termination configurable to expand the
|
|
range of possible measurement configurations and to enable self-calibration of the circuit.
|
|
|
|
Tampering with the mesh is likely to cause an impedance discontinuity. Cuts of one or both traces or a short circuit
|
|
between both traces will result in a total reflection of the incident pulse at the location of the fault, which our
|
|
circuit will easily detect as the delay of the response changes. However, beyond these simple cases, our approach can
|
|
also detect more subtle changes. For instance, a short circuit between two points along the same mesh trace will result
|
|
in a change in delay along this trace. Furthermore, even just probing a mesh trace with an oscilloscope probe will add
|
|
the probe's input capacitance, resulting in an impedance step. The TDR approach is thus able to not only detect but
|
|
distinguish and even localize several types of faults or attacks in a mesh.
|
|
|
|
\subsection{Signal Routing}
|
|
|
|
The stimulus pulse in a TDR-based design is a high-speed signal not unlike any other high-speed data or radio signal.
|
|
This enables the use of signal switch and multiplexer ICs marketed for RF or high-speed data bus applications. Due to
|
|
their mass-market applications, such devices are inexpensive. Using a tree-shaped topology of multiplexers, several mesh
|
|
segments can be monitored by a single frontend, enabling the monitoring of arbitrarily large volumes. As a proof of
|
|
concept, in our prototype we implemented software-controllable flipping of the mesh using \partno{TMUXHS4212} bus
|
|
multiplexers.
|
|
|
|
\subsection{Typical System Design and Threat Model}
|
|
\label{sec_system_design}
|
|
|
|
A typical system design for an HSM with TDR-based tamper sensing meshes would consist of a PCB assembly containing
|
|
payload components as well as the mesh monitoring circuit. Tamper-sensing meshes made from rigid or flexible PCBs would
|
|
enclose this PCB assembly from all directions. In this chapter we propose meshes that have a ground plane, which would
|
|
be on the outer side of the mesh PCBs and shield the system against electromagnetic interference. Mesh monitoring would
|
|
be battery powered and would periodically check for tamper attempts.
|
|
|
|
We consider an attacker motivated to extract the payload's secrets. Self-destruction by deleting secrets would suffice
|
|
as tamper response against this type of attacker. Such an attacker might want to probe parts of the payload circuit
|
|
using either conventional electrical contacts or using electromagnetic near-field probes that must be placed right on
|
|
top of the feature to be probed. An attacker might further attempt to manipulate the payload circuit, such as by
|
|
removing capacitors to enable a later power side-channel attack. In preparation for an optical fault-injection attack,
|
|
an attacker might attempt decapsulating some of the payload circuit's ICs either using laser ablation or using chemical
|
|
etching. An attacker might also attempt fault injection attacks using either electrical contacts or electromagnetic
|
|
fault injection probes near a target feature.
|
|
|
|
We consider attackers that have access to industry-standard SMD rework equipment such as microscopes, microsoldering
|
|
irons, and fine tweezers. We also consider attackers that have access to more advanced equipment, such as laboratory
|
|
measurement equipment like high-bandwidth oscilloscopes and waveform generators. We consider attackers with standard
|
|
equipment for mechanical manipulation including precision milling machines and cutters. We do not consider bespoke
|
|
attack tools, or specialized tools for large-scale industrial manufacturing such as industrial drilling machines.
|
|
|
|
\section{Circuit Design and Driving Approach}
|
|
|
|
\begin{figure}
|
|
\centering
|
|
\hspace*{-7mm}
|
|
\includegraphics[height=80mm]{block_diagram.pdf}
|
|
\caption[Sampling mesh monitor circuit block diagram]{Block diagram of our prototype sampling TDR security mesh
|
|
monitoring circuit.}
|
|
\label{fig_block_diagram}
|
|
\end{figure}
|
|
|
|
A TDR can be broken down into three basic components: A source of fast stimulus pulses (or edges!), a coupler that
|
|
separates stimulus pulses and their reflection at the output, and a fast ADC to capture the reflections.
|
|
|
|
Figure\ \ref{fig_block_diagram} shows a block diagram of our design\footnote{Full schematics are available in the
|
|
supplementary material of this thesis.}. At the core of our design lies an equivalent time sampling setup, where two
|
|
diode bridge sampling gates alternately sample the two traces of the mesh.
|
|
Since physical attacks happen on a time scale of minutes or hours, we do not need a fast acquisition rate. Equivalent
|
|
time sampling uses fast sampling gates to sample a high-frequency signal at a low frequency that is suitable for direct
|
|
conversion through an ADC. Using equivalent-time sampling, we can sample \unit{\giga\hertz}-Scale signals at the
|
|
\unit{\mega\hertz}-scale sampling rate of the internal ADCs of the commodity microcontroller we use. We use two of the
|
|
microcontroller's ADCs interleaved, each of which provides approximately \qty{1.7}{\mega Sp\per\second} at
|
|
\qty{12}{\bit} resolution. Due to the high conversion speed of the modern ADC cores in this microcontroller, we are able
|
|
to use up to $384\times$ oversampling for increased precision.
|
|
|
|
%A challenge in equivalent time sampling is precisely phase-synchronizing the sampling pulse to the fundamental
|
|
%frequency of the input signal, which is usually implemented by using a high-speed comparator. In a TDR-style frontend
|
|
%like ours, this expensive component can be avoided because the stimulus signal is generated in the frontend,
|
|
%simplifying the challenge of generating a synchronized sampling pulse at an adjustable phase to the stimulus pulse.
|
|
|
|
The mesh has low insertion loss. Thanks to the resulting large amplitude of the reflection signal, the noise floor of
|
|
our frontend based on commodity operational amplifiers (opamps) is below the resolution limit of the built-in ADCs of
|
|
our chosen microcontroller. The main source of frontend noise stems from timing jitter between the sampling gate and the
|
|
ADC due to the clock generation of the ADC, which could be reduced through firmware changes. The strong signal allows us
|
|
to use a comparatively lossy but simple \qty{-6}{\deci\bel} resistive tee instead of a directional coupler.
|
|
|
|
We implemented the sub-nanosecond sampler using a four-diode bridge sampling gate made from commodity \partno{BAT17-04W}
|
|
RF Schottky diodes, which offer turn-on times better than \qty{100}{\pico\second} at \price{0.13}{\euro} per device at
|
|
quantity 1000. In contrast to prior
|
|
work~\cite{polasekReflektometrCasoveOblasti2020,houtman1GHzSamplingOscilloscope2000}, we precisely control the timing of
|
|
our ADC and avoid the need for a second sampling stage.
|
|
|
|
We base our circuit around an \partno{STM32G474RB} microcontroller, \price{5}{\euro}-class commodity ARM
|
|
microcontroller. This is a recent part, which has internal ADCs that are both higher resolution and faster than those of
|
|
older parts. Furthermore, it includes a \emph{high-resolution timer} (\partno{HRTIM}) peripheral that provides better
|
|
than \qty{200}{\pico\second} timing resolution through self-calibrating delay lines. We use this peripheral to produce
|
|
adjustable, phase-locked stimulus and sampling pulses.
|
|
|
|
While the HRTIM peripheral provides sub-nanosecond phase adjustment, the digital outputs of the \partno{STM32G4} series
|
|
are limited to a minimum transition time of $t_r=t_f=\qty{1.7}{\nano\second}$\footnote{Datasheet specification, when
|
|
driving a \qty{10}{\pico\farad} load~\cite{stmicroelectronicsSTM32G474xBDatasheet2021}.}. We work around this issue with
|
|
two circuit tricks. First, we send the output through a fast amplifier to square up the edges to a rise time better than
|
|
\qty{500}{\pico\second}. We then reduce the \qty{10}{\nano\second} minimum pulse width supported by the \partno{HRTIM}
|
|
peripheral by applying a clip line~\cite{tektronixinc.TektronixS6Sampling1982} pulse forming network--i.e.\ we connect
|
|
the amplifier's output to the load in parallel with a short, terminated transmission line stub. The length of this stub
|
|
determines the pulse width.
|
|
|
|
\subsection{Driver Selection}
|
|
|
|
We evaluated multiple options for the pulse shaping amplifier in our design. For both sampling and stimulus, we work
|
|
with fully differential signals, so Current Mode Logic (CML) devices, which are widely used in high-speed logic, are a
|
|
natural fit. We settled on four parts for evaluation in this chapter: A \partno{74LVC2G157} standard logic IC, two
|
|
HDMI/DisplayPort redrivers, \partno{PI3HDX12211} and \partno{TDP0604}, as well as \partno{MAX3748}, a limiting amplifier
|
|
for optical networking. Figure\ \ref{fig_pic_amps} shows the four hand-soldered prototypes. We avoided specialty parts
|
|
such as the CML-output comparators made by Analog Devices due to cost.
|
|
|
|
\begin{figure}
|
|
\centering
|
|
\begin{subfigure}{0.23\textwidth}
|
|
\centering
|
|
\includegraphics[width=0.9\textwidth]{pic_74lvc_small.jpg}
|
|
\caption{74LVC2G157}
|
|
\end{subfigure}
|
|
\begin{subfigure}{0.23\textwidth}
|
|
\centering
|
|
\includegraphics[width=0.9\textwidth]{pic_max3748_small.jpg}
|
|
\caption{MAX3748}
|
|
\end{subfigure}
|
|
\begin{subfigure}{0.23\textwidth}
|
|
\centering
|
|
\includegraphics[width=0.9\textwidth]{pic_tdp0604_small.jpg}
|
|
\caption{TDP0604}
|
|
\end{subfigure}
|
|
\begin{subfigure}{0.23\textwidth}
|
|
\centering
|
|
\includegraphics[width=0.9\textwidth]{pic_pi3hdx_small.jpg}
|
|
\caption{PI3HDX12211}
|
|
\end{subfigure}
|
|
\caption[Sampling mesh monitor pulse amplifier implementations]{Implementation of the pulse amplifier variants of
|
|
the design. Amplifiers were mounted dead bug style on copper tape and connected with \qty{120}{\micro\meter}
|
|
wire. Supply rails were connected with copper tape where possible to reduce impedance. MLCC power supply
|
|
decoupling capacitors were placed on the copper tape to reduce loop area.}
|
|
\label{fig_pic_amps}
|
|
\end{figure}
|
|
|
|
\paragraph{Standard logic ICs.}
|
|
As a baseline, we evaluated the \partno{74LVC2G157} CMOS multiplexer configured to provide complementary outputs.
|
|
According to manufacturer specifications, this part provides slightly faster rise and fall times than
|
|
oumicrocontroller~\cite{renesaselectronicscorporationApplicationNoteAN2242019}.
|
|
|
|
\paragraph{Optical Networking Chipsets.}
|
|
Optical transceivers use CML-output limiting amplifiers and laser drivers, some of which are still available as discrete
|
|
components despite the industry moving from PCB implementations to direct bonding. We evaluated the \partno{MAX3748}
|
|
limiting amplifier as a representative part from this category.
|
|
|
|
\paragraph{Bus Redrivers.}
|
|
Most modern, high-speed buses like USB 3, PCI Express, HDMI, and Display Port use CML drivers. \emph{Redriver} ICs
|
|
intended to amplify such signals to compensate for loss in connectors or cables contain amplifiers that are suitable for
|
|
our application. HDMI/DisplayPort redrivers are most suitable since they can be configured as simple amplifiers,
|
|
turning off any signal-dependent power saving features.
|
|
|
|
In our evaluation below, we include \partno{PI3HDX12211} and \partno{TPD0604}, two inexpensive, consumer mass market
|
|
redrivers\footnote{
|
|
\partno{PI3HDX12211} is available at \price{2.11}{\euro} in single quantity and less than \price{1.30}{\euro} at a
|
|
quantity of several hundred at distributor LCSC, and \partno{TPD0604} is available at \price{4.72}{\euro} and
|
|
\price{3.44}{\euro}, respectively, at distributor Mouser}.
|
|
Both parts have four independent channels, so only one chip is needed for the two pulse paths.
|
|
|
|
\subsection{Cost Breakdown}
|
|
|
|
Table\ \ref{tab_bom} shows a breakdown of the cost of the main components of our prototype, totalling less than
|
|
\price{10}{\euro}. We did not include power supply components in this breakdown since our circuit is meant to be
|
|
embedded into a payload circuit that will already have sufficient power supplies. Our design works with strong signal
|
|
levels, and does not have special power supply requirements. In a practical implementation, it is unlikely that the
|
|
power supply would negatively affect performance.
|
|
|
|
Due to its \partno{HRTIM} peripheral, the \partno{STM32G4} microcontroller is the component of our design that is
|
|
hardest to replace. However, this part can still be replaced with a wide range of FPGAs, which commonly include
|
|
digitally configurable delay lines on their IO pins for signal de-skewing. For instance, the \partno{ODELAY} primitive
|
|
of Xilinx 7 Series FPGAs provides the same $\frac{1}{32}$ clock cycle resolution that the \partno{STM32G4}
|
|
\partno{HRTIM} peripheral provides while supporting higher input clock frequencies.
|
|
|
|
\begin{table}
|
|
\centering
|
|
\begin{tabular}{c|c|c|l}
|
|
\textbf{Part number}&\textbf{Amount}&\textbf{Cost in \euro}&\textbf{Description}\\\hline
|
|
PI3HDX12211&1&1.37&Pulse amplifier\\
|
|
STM32G474RB&1&3.51&Main microcontroller\\
|
|
OPA1656&1&1.25&Sampling post-amplifier\\
|
|
TMUXHS4212&2&0.64&Signal routing switch\\
|
|
SKYA21003&2&0.49&Termination switch\\
|
|
74LVC2G157&2&0.15&Pulse pre-conditioning\\
|
|
BAT17-04W&4&0.12&Sampling gates\\
|
|
N/A&25&0.01&Various MLCC capacitors\\
|
|
N/A&25&0.01&Various resistors\\\hline
|
|
\multicolumn{2}{r}{}&\textbf{9.67}&\textbf{Total}
|
|
\end{tabular}
|
|
\caption[Prototype design cost breakdown]{Cost breakdown of our prototype design. Prices are listed at order
|
|
quantity 1000 to make prices more comparable between distributors.}
|
|
\label{tab_bom}
|
|
\end{table}
|
|
|
|
\subsection{Measurement Principle and Scan Scheduling}
|
|
\label{sec_scan_schedule}
|
|
|
|
The goal of a time domain reflectometer is to send a pulse into the Device Under Test (DUT)--i.e.\ in our application,
|
|
the mesh--and to record all reflections returning from the DUT afterwards. In a security mesh with a few meters of total
|
|
trace length, the time span between the pulse being sent and the last reflections arriving from the end of the mesh is
|
|
in the order of tens of nanoseconds. Directly recording a response at this timescale would be infeasible in a commodity
|
|
microcontroller, so we use equivalent time sampling.
|
|
|
|
As shown in Figure\ \ref{fig_block_diagram}, our analog frontend contains amplifiers that produce the stimulus pulse, a
|
|
sampling gate with amplifiers, and a coupler that couples the pulse into the mesh and couples the reflections back into
|
|
the sampling gate. A microcontroller controls this frontend with two main signals: A stimulus pulse, and a sampling
|
|
pulse. By adjusting the timing between these two pulses every time a stimulus pulse is sent, the microcontroller can
|
|
sample the response at any chosen point in time. By sweeping across the whole time span, the microcontroller can
|
|
reconstruct the waveform of the reflected signal at the sampling gate.
|
|
|
|
In our prototype, we sample the response once after each stimulus pulse. We conservatively decided on a sampling rate of
|
|
\qty{1}{MSps} across both channels of the mesh's differential pair. This sampling rate leaves some headroom to the
|
|
\qty{50}{\mega\hertz} Gain-Bandwidth Product (GBP) of the \partno{OPA1656} frontend opamp, as well as the \qty{4}{MSps}
|
|
that the ADCs can reach. The processing speed of the microcontroller allows individual control of the timing of each
|
|
sampling pulse.
|
|
|
|
% major revision: Since we did all measurements for the majR with only 768 samples, we re-scaled the numbers in this
|
|
% paragraph accordingly.
|
|
In our prototype, one sweep of a \qty{141}{\nano\second} time span consisting of $768$ data points took
|
|
\qty{825}{\milli\second} at $384\times$ oversampling. The time span corresponds to \qty{21}{\meter} of mesh length,
|
|
which at a \qty{200}{\micro\meter} pitch corresponds to a mesh area of \qty{85}{\centi\meter\squared} and at a
|
|
\qty{1}{\milli\meter} pitch corresponds to \qty{426}{\centi\meter\squared}. By optimizing timing, moving oversampling
|
|
processing out of the interrupt handler, and by interleaving four instead of two of the microcontroller's five ADC
|
|
peripherals, the lower limit of acquisition time of a $768$-point scan is \qty{37}{\milli\second} for $384\times$
|
|
oversampling.
|
|
|
|
\subsection{ADC accuracy and noise immunity}
|
|
|
|
Our system uses high-frequency pulses for measurement, which inherently reject low-frequency noise components. Through
|
|
our TDR approach, both the stimulus and the sampling pulses are phase-locked, functioning similarly to a lock-in
|
|
amplifier. This significantly attenuates asynchronous noise. We excite the mesh with a differential signal, similar to
|
|
standards such as Ethernet or HDMI. Differential signaling cancels out external interference, which tends to affect both
|
|
lines equally\cite{bogatinSignalPowerIntegrity2018}.
|
|
|
|
Our front-end circuit is designed such that the analog signal entering the ADCs is strong and low in noise. Due to the
|
|
high sample rate of the microcontroller's internal ADCs, we can apply extensive oversampling ($384\times$) to enhance
|
|
resolution.
|
|
|
|
\section{Experimental Evaluation}
|
|
|
|
We evaluated our design in two phases. In the first phase, we measured the electrical performance of our sampling
|
|
circuit. The key figure in our application is the pulse generators' rise time, which determines the level of detail that
|
|
we are able to extract. Since we aim at fingerprinting a connected mesh, not at performing absolute measurements, we do
|
|
not need to characterize or de-embed the transfer function of our TDR frontend.
|
|
|
|
In the second phase, we evaluated the actual performance of our design on a set of 500 mesh test specimens of different
|
|
layouts and structure sizes. We include detailed performance figures for a simple baseline classifier for attack
|
|
detection.
|
|
|
|
\subsection{Rise Time Measurement}
|
|
|
|
The level of detail our frontend can extract from a mesh is limited by the rise time of the pulses it generates. We
|
|
characterized this rise time both externally, using a wideband spectrum analyzer (Section~\ref{sec_spec_risetime}), and
|
|
through self-characterization of the circuit (Section~\ref{sec_spec_risetime_selfchar}). Both measurements differ
|
|
because of the non-linear characteristic of the sampling Schottky pairs. Depending on the IC, our pulse generator
|
|
produces output waveforms with \qtyrange{470}{3200}{\milli\volt} differential voltage swing. Since the sampling diode
|
|
pairs start to conduct at a combined forward voltage of approximately \qty{300}{\milli\volt}, they will transition from
|
|
high impedance to low impedance during a corresponding \qty{300}{\milli\volt} window at the middle of the strobe pulse's
|
|
edge. Thus, even if the strobe pulse shows a low-pass response with rounding at both ends, as long as its slew rate
|
|
$\frac{\mathrm{d}V}{\mathrm{d}t}$ during the zero crossing is fast enough, the pulse will still result in a sharp
|
|
turn-on knee of the sampling diodes.
|
|
|
|
\subsubsection{Stimulus Pulse Rise Time at the Mesh}
|
|
\label{sec_spec_risetime}
|
|
|
|
\begin{figure}
|
|
\begin{center}
|
|
\begin{subfigure}{0.45\textwidth}
|
|
\centering
|
|
\includegraphics[width=\textwidth]{fig_spec_risetime_74lvc.pdf}
|
|
\vspace*{-5mm}
|
|
\caption{74LVC2G157}
|
|
\label{fig_spec_risetime_74lvc}
|
|
\end{subfigure}
|
|
\unskip\begin{subfigure}{0.45\textwidth}
|
|
\centering
|
|
\includegraphics[width=\textwidth]{fig_spec_risetime_max3748.pdf}
|
|
\vspace*{-5mm}
|
|
\caption{MAX3748}
|
|
\label{fig_spec_risetime_max3748}
|
|
\end{subfigure}
|
|
|
|
\begin{subfigure}{0.45\textwidth}
|
|
\centering
|
|
\includegraphics[width=\textwidth]{fig_spec_risetime_tdp0604.pdf}
|
|
\vspace*{-5mm}
|
|
\caption{TDP0604}
|
|
\label{fig_spec_risetime_tdp0604}
|
|
\end{subfigure}
|
|
\unskip\begin{subfigure}{0.45\textwidth}
|
|
\centering
|
|
\includegraphics[width=\textwidth]{fig_spec_risetime_pi3hdx.pdf}
|
|
\vspace*{-5mm}
|
|
\caption{PI3HDX12211}
|
|
\label{fig_spec_risetime_pi3hdx}
|
|
\end{subfigure}
|
|
\end{center}
|
|
\vspace*{-5mm}
|
|
\caption[Sampling mesh monitor stimulus pulse spectrum measurements]{Spectrum measurements and reconstructed time
|
|
domain edge shape of the stimulus pulse measured at the mesh interface for each of the four driver ICs, captured
|
|
using a spectrum analyzer. Vertical scale shows arbitrary units. Spectrum plots include a $\frac{1}{f}$
|
|
reference curve indicating an ideal infinite-bandwidth square wave.}
|
|
\label{fig_spec_risetime}
|
|
\end{figure}
|
|
|
|
To determine the rise time of our frontend's pulse generator, we measured the stimulus output at the mesh interface
|
|
using a Keysight N9020A MXA \qty{26.5}{\giga\hertz} signal analyzer\footnote{The spectrum analyzer used significantly
|
|
exceeded the capabilities of the fastest oscilloscopes we had access to, so it was the more appropriate choice of
|
|
measurement instrument.}. All measurements were taken with the prototype's mesh interface connected to the spectrum
|
|
analyzer through a bias tee configured for DC blocking followed by a \qty{20}{\deci\bel} attenuator for protection.
|
|
|
|
Figure\ \ref{fig_spec_risetime} and Table\ \ref{tab_edge_risetime} show the resulting measurements both in the frequency
|
|
domain (upper traces), and projected back into the time domain (lower traces) along with measured rise times. As
|
|
expected, the bare \partno{74LVC}-series logic gate has the slowest rise time at approximately \qty{500}{\pico\second}.
|
|
All three amplifier variants we implemented showed significantly improved rise time, with the \partno{PI4HDX12211}
|
|
achieving below \qty{200}{\pico\second}, and the other two showing around \qty{120}{\pico\second}. \partno{MAX3748} and
|
|
\partno{TDP0604} only achieved a low output signal amplitude, which stems from a combination of them having low output
|
|
amplitude by design and of our circuit loading their outputs heavily. Since their amplitude is only marginally within
|
|
the knee region of the RF Schottky diodes used in the sampling bridges, in these variants, the sampling gates end up
|
|
slower than the raw pulse rise time value alone would suggest.
|
|
|
|
\subsubsection{Self-Characterization}
|
|
\label{sec_spec_risetime_selfchar}
|
|
|
|
\begin{figure}
|
|
\begin{center}
|
|
\includegraphics[width=\textwidth]{fig_edge_risetime.pdf}\vspace*{-7mm}
|
|
\end{center}
|
|
\caption[Sampling mesh monitor pulse self-characterization]{One edge of the stimulus pulse with no mesh connected
|
|
measured by the board itself, using different amplifier ICs. For each IC, ten traces are shown. The vertical
|
|
scale is in Volts at the sampling amplifier output.}
|
|
\label{fig_edge_risetime}
|
|
\end{figure}
|
|
|
|
\begin{table}
|
|
\begin{center}
|
|
\begin{tabular}{r|cccc}
|
|
\textbf{IC}
|
|
&\partno{74LVC2G157}
|
|
&\partno{MAX3748}
|
|
&\partno{TDP0604}
|
|
&\partno{PI3HDX12211}\\\hline
|
|
|
|
\textbf{$t_r$ (Self-Characterization)}&
|
|
\qty{916}{\pico\second}&
|
|
\qty{743}{\pico\second}&
|
|
\qty{333}{\pico\second}&
|
|
\qty{264}{\pico\second}\\
|
|
|
|
\textbf{$t_r$ (Stimulus at Mesh)}&
|
|
\qty{573}{\pico\second}&
|
|
\qty{125}{\pico\second}&
|
|
\qty{119}{\pico\second}&
|
|
\qty{191}{\pico\second}\\
|
|
|
|
\textbf{Stimulus Pulse $V_{pp}$}&
|
|
\qty{1600}{\milli\volt}&
|
|
\qty{236}{\milli\volt}&
|
|
\qty{254}{\milli\volt}&
|
|
\qty{430}{\milli\volt}\\
|
|
|
|
\textbf{Effective Slew Rate}&
|
|
\qty{2.79}{\volt\per\nano\second}&
|
|
\qty{1.89}{\volt\per\nano\second}&
|
|
\qty{2.13}{\volt\per\nano\second}&
|
|
\qty{2.25}{\volt\per\nano\second}
|
|
\end{tabular}
|
|
\end{center}
|
|
\caption[Single-ended stimulus edge rise times for different amplifier ICs]{Single-ended stimulus edge rise times
|
|
for different amplifier ICs. The single-ended rise times of both positive and negative half of the differential
|
|
pair have been averaged. External measurements are from Figure\ \ref{fig_spec_risetime}, measuring the stimulus
|
|
pulse at the mesh interface. $V_{pp}$ measurements are taken at the mesh interface. Effective slew rates are
|
|
calculated from the external measurements and pulse $V{pp}$.}
|
|
\label{tab_edge_risetime}
|
|
\end{table}
|
|
|
|
While a fast edge is a necessary component for a fast sampling gate, the concrete speed of the sampling gate also
|
|
depends on other factors such as the pulse's amplitude. Figure\ \ref{fig_edge_risetime} shows the result of our
|
|
self-characterization experiments, where we used the frontend to measure its own pulse shape representing its concrete
|
|
sampling performance. In these experiments, we used $256\times$ oversampling at \qty{12}{b} ADC resolution. The plots
|
|
show the voltage at the ADC input against time in \unit{\nano\second}. The absolute voltage levels are not relevant here
|
|
- only the rise time is. Since we use some of these amplifiers--particularly the redriver ICs--well outside of their
|
|
intended application, the actual voltage they develop across the nonlinear load that our sampling gate's diode bridge
|
|
presents depends on implementation details of the amplifier's CML output stage. To maximize ADC resolution and minimize
|
|
ringing, we tuned gain and bandwidth of each post-sampling amplifier for each IC. Ringing in the amplifier output leads
|
|
to jitter in the ADC's sampling period to directly feeding through to the ADC output value. Since in \partno{STM32}
|
|
MCUs, the ADC is clocked independently of the rest of the system, its sampling timing is poorly
|
|
controlled and this jitter causes a significant error unless the amplifier is well-compensated.
|
|
|
|
Table\ \ref{tab_edge_risetime} shows rise times calculated from each trace, averaged across both traces of the
|
|
differential pair. Our results show that the optical networking limiting amplifier produces slower edges than the
|
|
measurements from Figure\ \ref{fig_spec_risetime} would suggest. We suspect that this is caused by its low output
|
|
amplitude resulting in part from its specifications and in part from a poor match between its CML output structure and
|
|
the nonlinear impedance presented by the sampling diode bridges. Surprisingly, even the \partno{74LVC2G157} baseline
|
|
unit has a rise time of less than \qty{1}{\nano\second}. We estimate that this is caused by the large output voltage
|
|
swing of this part, going from ground to its $V_{CC}$ at \qty{3.3}{\volt}. Due to the construction of our sampling gate,
|
|
its switching happens in the short period between its input differential voltage crossing zero and it rising above the
|
|
combined forward voltage of the Schottky diodes. Thus, while the \partno{74LVC} might produce slow edges overall, its
|
|
large output swing results in a high slew rate in the critical region around the zero crossing.
|
|
|
|
\begin{figure}
|
|
\begin{center}
|
|
\begin{subfigure}{0.45\textwidth}
|
|
\centering
|
|
\includegraphics[width=\textwidth]{edge_sampling_pulse_scope.pdf}
|
|
\vspace*{-5mm}
|
|
\caption{Sampling pulse}
|
|
\label{fig_osc_risetime_samp}
|
|
\end{subfigure}
|
|
\unskip\begin{subfigure}{0.45\textwidth}
|
|
\centering
|
|
\includegraphics[width=\textwidth]{edge_stimulus_pulse_scope_normalized.pdf}
|
|
\vspace*{-5mm}
|
|
\caption{Stimulus pulse}
|
|
\label{fig_osc_risetime_stim}
|
|
\end{subfigure}
|
|
\end{center}
|
|
\vspace*{-5mm}
|
|
\caption[Pulse risetime oscilloscope measurements]{Oscilloscope measurements of the sampling pulse probed
|
|
differentially (left) and of the stimulus pulse probed single-ended and normalized (right). The 74LVC pulse is
|
|
plotted on the right Y axis in the left plot due to its large amplitude. In the right plot, it is not shown
|
|
since our measurement setup did not allow for a measurement of this amplitude.}
|
|
\label{fig_osc_risetime}
|
|
\end{figure}
|
|
|
|
Figure~\ref{fig_osc_risetime} shows the sampling and stimulus pulse edges measured using a Siglent SDS7404A
|
|
\qty{4}{\giga\hertz} oscilloscope. The stimulus pulse was directly measured single-ended, and the sampaling pulse was
|
|
measured differentially through a Siglent SAP2500D \qty{2.5}{\giga\hertz} active differential probe. These measurements
|
|
support the conclusion from Figure~\ref{fig_spec_risetime} that in raw edge risetime, \partno{MAX3748} and
|
|
\partno{TDP0604} perform fastest, with \partno{PI3HDX12211} being slightly slower. They also exhibit the large
|
|
differences in amplitude that we expect cause the differences in actual measurement performance as shwon in
|
|
Figure~\ref{fig_edge_risetime}. Note that due to the differences in measurement methodology, a direct comparison of the
|
|
rise times is not possible between these plots. The spectrum measurements do not convey amplitude information and
|
|
discard low-frequency content, but due to the very large bandwidth of the spectrum analyzer used, they will represent
|
|
the true risetime the closest. In both the self-characterization and the oscilloscope measurements, the displayed
|
|
risetime is contaminated by the measurement system. In case of the self-characterization, the stimmulus rise time is
|
|
folded into the measurement result, leading in the displayed risetime being slower by a factor of $\sqrt{2}$. Similarly,
|
|
in the oscilloscope measurements, the combined risetime of the oscilloscope frontend and active probe contaminate the
|
|
results.
|
|
|
|
We observed the best overall performance with the \partno{PI3HDX12211} redriver, resulting in a rise time of
|
|
\qty{264}{\pico\second}. In this test specimen, we fed the pulse through the amplifier twice since we had two unused
|
|
channels, and we used \qty{200}{\pico\second} clip lines on the amplifier's output for pulse shaping. We only used clip
|
|
lines here and for \partno{TDP0604} since the other amplifiers' output did not contain sufficient harmonic content.
|
|
|
|
\subsection{Mesh Specimen Characterization}
|
|
|
|
\begin{table}
|
|
\begin{center}
|
|
\begin{tabular}{r|cccc}
|
|
\textbf{Mesh}
|
|
&1
|
|
&2
|
|
&3
|
|
&4\\\hline
|
|
|
|
\textbf{Size}&
|
|
$35\times\qty{70}{\milli\meter}$&
|
|
$35\times\qty{70}{\milli\meter}$&
|
|
$35\times\qty{70}{\milli\meter}$&
|
|
$35\times\qty{70}{\milli\meter}$\\
|
|
|
|
\textbf{Area}&
|
|
$\qty{24.5}{\centi\meter^2}$&
|
|
$\qty{24.5}{\centi\meter^2}$&
|
|
$\qty{24.5}{\centi\meter^2}$&
|
|
$\qty{24.5}{\centi\meter^2}$\\\hline
|
|
|
|
\textbf{Trace width}&
|
|
\qty{150}{\micro\meter}&
|
|
\qty{200}{\micro\meter}&
|
|
\qty{300}{\micro\meter}&
|
|
\qty{500}{\micro\meter}\\
|
|
|
|
\textbf{Trace spacing}&
|
|
\qty{150}{\micro\meter}&
|
|
\qty{200}{\micro\meter}&
|
|
\qty{300}{\micro\meter}&
|
|
\qty{500}{\micro\meter}\\
|
|
|
|
\textbf{Trace pitch}&
|
|
\qty{300}{\micro\meter}&
|
|
\qty{400}{\micro\meter}&
|
|
\qty{600}{\micro\meter}&
|
|
\qty{1.00}{\milli\meter}\\\hline
|
|
|
|
\textbf{Trace length}&
|
|
\qty{1.07}{\meter}&
|
|
\qty{1.93}{\meter}&
|
|
\qty{2.86}{\meter}&
|
|
\qty{3.86}{\meter}\\
|
|
|
|
\textbf{Approximate Delay}&
|
|
\qty{7.1}{\nano\second}&
|
|
\qty{13}{\nano\second}&
|
|
\qty{19}{\nano\second}&
|
|
\qty{26}{\nano\second}\\
|
|
\end{tabular}
|
|
\end{center}
|
|
\caption[Mesh test specimen specifications]{Specifications of mesh test specimens used in the experiments in this
|
|
chapter. Approximate signal delays were calculated using wave velocity
|
|
$v=\frac{c}{\sqrt{\epsilon_r}}\approx\frac{c}{2}$~\cite{wheelerTransmissionLinePropertiesParallel1965} assuming
|
|
$\epsilon_r\approx 4$~\cite{mumbyDielectricPropertiesFR41989} for the test specimens' \partno{FR-4} substrate.}
|
|
\label{tab_mesh_spec}
|
|
\end{table}
|
|
|
|
To measure the practical performance of our prototype, we created a set of tamper sensing mesh test specimens. Each
|
|
specimen contains four separate meshes with the same area. Table~\ref{tab_mesh_spec} shows the design specifications.
|
|
Each specimen contains four separate meshes on the outer layers of a four-layer, \qty{1.0}{\milli\meter} thickness PCB,
|
|
two equal-size meshes on each side. The inner layers were used as ground. Figure\ \ref{fig_mesh_length} shows the
|
|
results of a baseline measurement of each mesh using each design variant. The step response resulting from an edge
|
|
entering the mesh and its reflection arriving back at the start after traversing the mesh back and forth is clearly
|
|
visible.
|
|
|
|
We validated the results from Figure\ \ref{fig_mesh_length} by calculating speed of light in our mesh specimen's
|
|
substrate based on them. The resulting measurements are shown in Table\ \ref{tab_speed_of_light}. All amplifier
|
|
configurations yield comparable measurements of approximately \qty{1.6}{\meter\per\second}, which corresponds with the
|
|
expected signal propagation velocity in \partno{FR-4} PCB material of
|
|
\qty{1.5d8}{\meter\per\second}~\cite{wheelerTransmissionLinePropertiesParallel1965,mumbyDielectricPropertiesFR41989}.
|
|
|
|
The graphs in Figure~\ref{fig_mesh_length} show a dispersion effect that increasingly rounds off the trailing edge of
|
|
the response with longer mesh lengths. This effect stems from higher-frequency components coupling into adjacent trace
|
|
segments further up or down the mesh, spreading high-frequency components of the response signal out throughout time.
|
|
This effect is less visible in the \partno{74LVC} measurements, which we suspect is a result of this variant's large
|
|
pulse amplitude, which enables reflected response components to forward-bias the sampling gate's diode bridges,
|
|
resulting in amplitude clipping.
|
|
|
|
From this dispersion effect follows a key point for the design of practical security meshes: To increase the temporal
|
|
resolution of TDR mesh monitoring, meshes should be broken up into segments that are multiplexed through signal
|
|
switching.
|
|
|
|
\begin{figure}
|
|
\begin{center}
|
|
\includegraphics[width=.8\textwidth]{fig_mesh_length.pdf}
|
|
\vspace*{-10mm}
|
|
\end{center}
|
|
\caption[Sampling mesh monitor time-domain responses versus mesh length and amplifier]{TDR responses captured by the
|
|
microcontroller's internal ADCs with each of four candidate pulse amplifier ICs and four test meshes. The shown
|
|
time range covers the primary reflection of the stimulus pulse's falling edge. For clarity, only one channel of
|
|
the differential response is shown.}
|
|
\label{fig_mesh_length}
|
|
\end{figure}
|
|
|
|
\begin{table}
|
|
\begin{center}
|
|
\begin{tabular}{r|cccc|c}
|
|
&\multicolumn{4}{c|}{Mesh}&\\
|
|
Pulse amplifier IC&
|
|
1&
|
|
2&
|
|
3&
|
|
4&
|
|
Calculated speed of light $c$
|
|
\\\hline
|
|
|
|
\partno{PI3HDX12211}&
|
|
\qty{16.9}{\nano\second}&
|
|
\qty{26.0}{\nano\second}&
|
|
\qty{36.4}{\nano\second}&
|
|
\qty{46.1}{\nano\second}&
|
|
$\qty{1.59d8}{\meter\per\second}$\\
|
|
|
|
\partno{74LVC2G157}&
|
|
\qty{17.1}{\nano\second}&
|
|
\qty{26.4}{\nano\second}&
|
|
\qty{36.6}{\nano\second}&
|
|
\qty{48.2}{\nano\second}&
|
|
$\qty{1.55d8}{\meter\per\second}$\\
|
|
|
|
\partno{MAX3748}&
|
|
\qty{17.2}{\nano\second}&
|
|
\qty{26.4}{\nano\second}&
|
|
\qty{36.6}{\nano\second}&
|
|
\qty{45.6}{\nano\second}&
|
|
$\qty{1.59d8}{\meter\per\second}$\\
|
|
|
|
\partno{TDP0604}&
|
|
\qty{17.0}{\nano\second}&
|
|
\qty{26.2}{\nano\second}&
|
|
\qty{36.5}{\nano\second}&
|
|
\qty{45.8}{\nano\second}&
|
|
$\qty{1.59d8}{\meter\per\second}$\\
|
|
\end{tabular}
|
|
\end{center}
|
|
\caption[Speed of light calculations]{Speed of light and time offset calculated from delays read from the graphs in
|
|
Figure\ \ref{fig_mesh_length}. $c$ is the speed of light determined by linear fit.}
|
|
\label{tab_speed_of_light}
|
|
\end{table}
|
|
|
|
\subsection{Classification performance}
|
|
\label{sec-class-perf}
|
|
|
|
To evaluate the practical performance of our system, we captured approximately 1250 measurement series under a variety
|
|
of environmental and attack conditions and evaluated its performance using a simple template-matching classifier. In
|
|
each measurement series, we captured 7 differential traces with $2\times768$ points per trace. One differential trace
|
|
served as a calibration reference with the multiplexers configured to disconnect the mesh. The other six traces cover
|
|
each of open circuit, short circuit, and matched load termination measuring each of the two traces of the mesh once from
|
|
each of both ends for 12 channels total ($\{\text{open}, \text{short}, \text{load}\} \times \{\text{forward},
|
|
\text{reverse}\} \times \{\text{mesh trace A}, \text{mesh trace B}\}$).
|
|
|
|
Our classifier is designed to compare two measurement series and produce a scalar score indicating their similarity. A
|
|
simple threshold can then be applied on the similarity score to decide the class. Type 1 and type 2 error rates can be
|
|
tuned by adjusting this threshold.
|
|
|
|
Our classifier proceeds in four steps: B-spline smoothing, per-channel Pearson Correlation Coefficient, averaging all
|
|
channel results, and applying a threshold. B-spline smoothing serves as a low-pass filter, evening out random noise. We
|
|
calculate the Pearson Correlation Coefficient for each measurement channel separately, producing a vector with 12
|
|
entries. We average the components of this vector to a single, scalar similarity score.
|
|
|
|
\subsubsection{Interpreting these performance plots}
|
|
Figure~\ref{fig_layout_identity} shows the similarity score of multiple intact meshes. For each performance measurement,
|
|
we show the similarity scores for each pair of measurements as a matrix, with each measurement appearing once in each
|
|
row and column. High values indicate similarity, low values indicate differences. We show the baseline measurement set
|
|
in the top left quadrant of the plot (1), and the experiment set bottom right (4), separated by white lines. Uniform
|
|
color within the top left quadrant (1) indicates high similarity between baseline measurements. Nonuniform color in the
|
|
bottom right (4) is expected, and indicates that mutliple experiment (attack) measurements are unlike each other.
|
|
Classification performance is indicated by the top right (2) and bottom left (3) quadrants, which indicate
|
|
misclassification probability. Misclassification is likely when the top left (1) and top right (2) quadrants look alike.
|
|
Misclassification is less likely the more they differ.
|
|
|
|
Under each figure, we give the False Negative Rate (FNR) when the threshold is adjusted for a False Positive Rate (FPR)
|
|
of $0.1\%$ as a reference point\footnote{We denote the rate of missed alarms as FNR and the false alarm rate as FPR.}.
|
|
We also provide the Crossover Error Rate (CER) at which for some threshold FPR is equal to FNR. We calculate all error
|
|
rates assuming the similarity scores are normally distributed. We chose a reference point of $0.1\%$ FPR since it allows
|
|
for a meaningful comparison based on the hundreds of measurements our data is based on. In a practical application, the
|
|
end-to-end FPR of the alarm system would need to be significantly lower, probably in the range from $10^{-12}$ to
|
|
$10^{-9}$ for a Mean Time Between Failures (MTBF) of several years. A practical system would likely include additional
|
|
components filtering the output of our proposed baseline classifier analyzing not just the last, but multiple previous
|
|
measurements. Experimentally evaluating a classifier to this degree of precision would require a large-scale experiment
|
|
to account for the long tail of the error distribution.
|
|
|
|
Figure~\ref{fig_layout_identity_layout} compares several copies of the same mesh (top left quadrant, 1) to four variants
|
|
that have the same pitch and area, but different randomized layout of the traces (bottom right). Our classifier can
|
|
distinguish mesh layouts with a 18\% FNR at 0.1\% FPR.
|
|
|
|
The variance between samples of the baseline group in Figure~\ref{fig_layout_identity_layout} alerted us to the
|
|
possibility that while all mesh samples of the same layout were supposed to be identical copies, our measurement circuit
|
|
might be sensitive enough to pick up on manufacturing variations from one copy to another in a PUF-like manner. To
|
|
evaluate this scenario, in Figure~\ref{fig_layout_identity_identity} we show the result of repeated measurements of
|
|
three copies of the same mesh. The measurements were taken interleaved ($1, 2, 3, 1, 2, \hdots$) to exclude systematic
|
|
errors. We found our system can indeed distinguish multiple copies of the same mesh at a 1.7\% FNR at 0.1\% FPR. We
|
|
leave a detailed analysis of this effect to future work. For the scope of this chapter, the presence of this effect
|
|
indicates good performance of our design, and increases the detection efficiency of our approach.
|
|
|
|
\begin{figure}
|
|
\centering
|
|
\begin{subfigure}[t]{0.4\textwidth}
|
|
\includegraphics[width=\textwidth]{fig_covar_distinguish_layouts.pdf}
|
|
\caption{Five copies of the same layout compared to four other layouts. FNR 18\% at 0.1\% FPR, CER=8.3\%.}
|
|
\label{fig_layout_identity_layout}
|
|
\end{subfigure}
|
|
\hspace*{5mm}
|
|
\begin{subfigure}[t]{0.4\textwidth}
|
|
\centering
|
|
\includegraphics[width=0.7\textwidth]{fig_covar_distinguish_copies_large_run.pdf}
|
|
\caption{Three identical copies, 20 measurements each. FNR 1.7\% at 0.1\% FPR, CER=1.1\%.}
|
|
\label{fig_layout_identity_identity}
|
|
\end{subfigure}
|
|
\hfill
|
|
\caption{Similarity matrices of measurement series on intact meshes.}
|
|
\label{fig_layout_identity}
|
|
\end{figure}
|
|
|
|
\subsubsection{Basic attacks}
|
|
|
|
\begin{figure}
|
|
\begin{subfigure}[t]{0.23\textwidth}
|
|
\includegraphics[width=\textwidth]{fig_covar_open_p0.3.pdf}
|
|
\caption{One trace interrupted, p=\qty{0.3}{\milli\meter}. FNR 0.0\% at 0.1\% FPR, CER=0.0\%.}
|
|
\end{subfigure}
|
|
\hfill
|
|
\begin{subfigure}[t]{0.23\textwidth}
|
|
\includegraphics[width=\textwidth]{fig_covar_short_across_traces_p0.3.pdf}
|
|
\caption{Both traces shorted, p=\qty{0.3}{\milli\meter}. FNR 0.0\% at 0.1\% FPR, CER=0.0\%.}
|
|
\end{subfigure}
|
|
\hfill
|
|
\begin{subfigure}[t]{0.23\textwidth}
|
|
\includegraphics[width=\textwidth]{fig_covar_open_p0.4.pdf}
|
|
\caption{One trace interrupted, p=\qty{0.4}{\milli\meter}. FNR 0.0\% at 0.1\% FPR, CER=0.0\%.}
|
|
\end{subfigure}
|
|
\hfill
|
|
\begin{subfigure}[t]{0.23\textwidth}
|
|
\includegraphics[width=\textwidth]{fig_covar_short_across_traces_p0.4.pdf}
|
|
\caption{Both traces shorted, p=\qty{0.4}{\milli\meter}. FNR 0.0\% at 0.1\% FPR, CER=0\%.}
|
|
\end{subfigure}
|
|
\caption[Similarity matrices of modified meshes under different attack scenarios]{Similarity matrix of 10 intact and
|
|
10 modified meshes with two pitch sizes under two different attack scenarios: An interrupted trace, and both
|
|
mesh traces shorted.}
|
|
\label{fig_covar_basic_attacks}
|
|
\end{figure}
|
|
|
|
Figure~\ref{fig_covar_basic_attacks} shows the performance of our classifier under the two basic attack scenarios of an
|
|
interrupted trace, and a short circuit between the mesh's differential traces. Such attacks lead to large changes in the
|
|
location of the reflected pulse edge, resulting in 0\% Crossover Error Rate.
|
|
|
|
\subsubsection{Trace shortening}
|
|
|
|
\begin{figure}
|
|
\centering
|
|
\includegraphics[width=0.33\textwidth,trim=0 5mm 0 5mm]{fig_covar_short_within_0.3.pdf}
|
|
\caption[Similarity matrix of shorted meshes]{Similarity matrix of several mesh specimens that have one trace
|
|
shorted to an adjacent location on the same trace. Classification FNR 23\% at 0.1\% FPR, CER=22\%.}
|
|
\label{fig_short_within}
|
|
\end{figure}
|
|
|
|
Figure~\ref{fig_short_within} shows classification results when one trace is short circuited to another location within
|
|
the same trace. Here, the resulting distortion in response shape is harder to detect. Depending on the length of the
|
|
shorted-out section, the timing skew such modifications introduce may be as little as a few picoseconds. For some
|
|
samples which have longer sections of mesh trace shorted out, this attack is easy to distinguish, but for others, our
|
|
classifier cannot distinguish it leading to an overall FNR of 18\% at 0.1\% FPR, with some specimens reliably detected,
|
|
and others never detected.
|
|
|
|
\subsubsection{Advanced attacks}
|
|
\label{sec_advanced_attack}
|
|
|
|
\begin{figure}
|
|
\begin{subfigure}[t]{0.23\textwidth}
|
|
\includegraphics[width=\textwidth]{fig_covar_probe_0.3.pdf}
|
|
\caption{Oscilloscope probe contacting mesh. FNR 0.0\% at 0.1\% FPR, CER=0.0\%.}
|
|
\label{fig_covar_adv_probe}
|
|
\end{subfigure}
|
|
\hfill
|
|
\begin{subfigure}[t]{0.23\textwidth}
|
|
\includegraphics[width=\textwidth]{fig_covar_soldering_p0.3.pdf}
|
|
\caption{Soldering iron touching mesh. FNR 0.0\% at 0.1\% FPR, CER=0.0\%.}
|
|
\label{fig_covar_adv_soldering}
|
|
\end{subfigure}
|
|
\hfill
|
|
\begin{subfigure}[t]{0.23\textwidth}
|
|
\includegraphics[width=\textwidth]{fig_covar_antenna_wire_30mm_p0.3.pdf}
|
|
\caption{30mm wire soldered to mesh. FNR 9.6\% at 0.1\% FPR, CER=6.7\%.}
|
|
\label{fig_covar_adv_antenna}
|
|
\end{subfigure}
|
|
\hfill
|
|
\begin{subfigure}[t]{0.23\textwidth}
|
|
\includegraphics[width=\textwidth]{fig_covar_probe_points_p0.3.pdf}
|
|
\caption{Baseline vs. experiment specimens with no attack.}
|
|
\label{fig_covar_adv_baseline}
|
|
\end{subfigure}
|
|
\caption{Classifier performance under advanced attack scenarios.}
|
|
\label{fig_covar_adv_attack}
|
|
%too much: fig_covar_soldering_p0.3_minmax.pdf
|
|
%too much: fig_covar_antenna_wire_30mm_p0.3_minmax.pdf
|
|
\end{figure}
|
|
|
|
Figure~\ref{fig_covar_adv_attack} shows our classifier's performance under conditions similar to actions an attacker
|
|
would perform during an attack: An oscilloscope probe\footnote{Part number Rigol PVP3150.} touching one mesh trace
|
|
(Figure~\ref{fig_covar_adv_probe}), a soldering iron touching one mesh trace (Figure~\ref{fig_covar_adv_soldering}), and
|
|
a mesh where one trace has a $l=\qty{30}{\milli\meter},d=\qty{120}{\micro\meter}$ piece of copper wire soldered to one
|
|
trace (Figure~\ref{fig_covar_adv_probe}). Our classifier is able to clearly distinguish the probing and soldering iron
|
|
cases at 0\% FNR, with a maximum of 9.6\% FPR at 0.1\% FNR in the soldered wire case.
|
|
|
|
\subsubsection{Patching attacks}
|
|
\label{sec_attack_probe}
|
|
|
|
\begin{figure}
|
|
\begin{subfigure}[t]{0.27\textwidth}
|
|
\includegraphics[width=\textwidth]{fig_covar_patch_interleave_baseline.pdf}
|
|
\caption{Test boards before experiment.}
|
|
\label{fig_covar_patch_attack_baseline}
|
|
\end{subfigure}
|
|
\hfill
|
|
\begin{subfigure}[t]{0.27\textwidth}
|
|
\includegraphics[width=\textwidth]{fig_covar_patch_ref_exp_interleave_direct.pdf}
|
|
\caption{Experiment specimen compared to reference before and after attack.}
|
|
\label{fig_covar_patch_attack_direct}
|
|
\end{subfigure}
|
|
\hfill
|
|
\begin{subfigure}[t]{0.4\textwidth}
|
|
\includegraphics[width=\textwidth]{fig_patch_interleave_scatter.pdf}
|
|
\caption{Trajectory of relative difference to reference specimens.}
|
|
\label{fig_covar_patch_attack_scatter}
|
|
\end{subfigure}
|
|
\hfill
|
|
\caption{Classifier performance under a patching attack that bridges a short gap within a mesh
|
|
trace using wire.}
|
|
\label{fig_covar_patch_attack}
|
|
\end{figure}
|
|
|
|
PCB tamper sensing meshes are susceptible to industry-standard PCB rework techniques. If we assume a standard PCB
|
|
process with \qty{100}{\micro\meter} trace/space design rules, a drilling attack targeting a \qty{300}{\micro\meter}
|
|
hole size requires cutting and patching at least one trace~\cite{immlerSecurePhysicalEnclosures2018}. We performed such
|
|
an attack on a set of \qty{300}{\micro\meter} pitch meshes. Figure\ \ref{fig_drill_mod_shape} shows our modification and
|
|
the resulting change in the time-domain response.
|
|
|
|
Figure~\ref{fig_covar_patch_attack} shows the classification result of this attack. To extract the subtle effect of this
|
|
attack, we measured two reference specimens, one control, and one experiment specimen twice: Once before the attack, and
|
|
once after. Measurements were interleaved and repeated 10 times. Factors such as temperature drift can be excluded by
|
|
comparing both control and experiment measurements against the two references before and after the modification.
|
|
Figure~\ref{fig_covar_patch_attack_baseline} shows the four samples before the attack, exhibiting the same subtle
|
|
PUF-like effect that we described in Section~\ref{sec-class-perf}. Since we peform both before and after measurements on
|
|
the same sample, we can separate this effect from the effect of the attack. Figure~\ref{fig_covar_patch_attack_direct}
|
|
compares both control and experiment samples before and after the attack, and shows a clear change in the experiment
|
|
sample during the attack. Figure~\ref{fig_covar_patch_attack_scatter} plots the similarity scores of both samples to
|
|
each of the two reference samples. We can see that the control distribution stays in one place, while the experiment
|
|
distribution shifts.
|
|
|
|
\begin{figure}
|
|
\centering
|
|
\begin{subfigure}{0.78\textwidth}
|
|
\centering
|
|
\includegraphics[width=\textwidth]{fig_drill_mod_shape_new.pdf}
|
|
\label{fig_drill_mod_shape_plot}
|
|
\end{subfigure}
|
|
\begin{subfigure}{0.2\textwidth}
|
|
\centering
|
|
\includegraphics[width=\textwidth]{pic_manip_microsoldering_new_small.jpg}
|
|
\vspace*{2mm}
|
|
\label{fig_drill_mod_shape_pic}
|
|
\end{subfigure}
|
|
\caption[Time-domain mesh response differences during manipulation attack]{The mesh response under a manipulation
|
|
attack patching across a drill location for a \qty{300}{\micro\meter} drill, as captured by the
|
|
microcontroller's ADCs. The mesh pitch is \qty{300}{\micro\meter}. B-spline smoothing was applied for
|
|
readability.}
|
|
\label{fig_drill_mod_shape}
|
|
\end{figure}
|
|
|
|
Based on the above results, we peformed a larger-scale experiment using ten interleaved measurements each of seven
|
|
samples with patches applied compared against baseline measurements taken before and after measuring the experiment
|
|
samples.. Figure~\ref{fig_patch_large_scale} shows the results of this experiment, resulting in a FNR of 71.5\% at 0.1\%
|
|
FPR. Since such patches only affect few data points along the reflection response, we included a variant of our
|
|
classifier that uses the maximum difference across all channels instead of the averaged Pearson Correlation Coefficient
|
|
to improve sensitivity to the subtle, localized effects of such patches. Using this classifier variant, FNR improves to
|
|
51.1\%, detecting half of all attack attempts in a single measurement when fixing the false alarm rate at 0.1\%.
|
|
In a practical application, detection rates would be higher since the system would be able to observe the entire process
|
|
of patching. As shown in Section~\ref{sec_advanced_attack}, soldering for instance is highly detectable, while here we
|
|
only benchmark a momentary snapshot after the patch was completed.
|
|
|
|
\begin{figure}
|
|
\centering
|
|
\begin{subfigure}{0.3\textwidth}
|
|
\centering
|
|
\includegraphics[width=\textwidth]{fig_covar_patch_repeat_p0.3.pdf}
|
|
\caption{Micro-soldering patching attack. FNR 71.5\% at 0.1\% FPR, CER=29\%.}
|
|
\label{fig_patch_large_scale_corr}
|
|
\end{subfigure}
|
|
\hspace*{5mm}
|
|
\begin{subfigure}{0.3\textwidth}
|
|
\centering
|
|
\includegraphics[width=\textwidth]{fig_covar_patch_repeat_p0.3_minmax.pdf}
|
|
\caption{\emph{maximum} classifier variant. FNR 51.1\% at 0.1\% FPR, CER=15\%.}
|
|
\label{fig_patch_large_scale_minmax}
|
|
\end{subfigure}
|
|
\caption[Classification performance in a large-scale experiment]{Classification performance in a larger-scale
|
|
experiment using 10 measurements each of 7 samples with traces patched through micro-soldering.}
|
|
\label{fig_patch_large_scale}
|
|
\end{figure}
|
|
|
|
\subsubsection{Environmental susceptibility}
|
|
|
|
Figure~\ref{fig_env_effects} shows the results of a series of experiments evaluating the effect of environmental factors
|
|
such as handling or electromagnetic interference on our measurements. Figure~\ref{fig_env_effects_time} shows our
|
|
measurements exhibit little time drift (CER=60\%). Figure~\ref{fig_env_effects_touch} shows that touching the mesh is
|
|
easily detected (FNR=0\%), but the system is insensitive to touching other parts of the circuit.
|
|
We classify touching the mesh as an attack since the mesh would be shielded from touch by the ground plane in a
|
|
practical scenario (cf.\ Section~\ref{sec_system_design}).
|
|
|
|
As shown in Figure~\ref{fig_env_effects_heat}, heating the mesh distors its measurements (FNR=0.6\%, CER=0\%).
|
|
Figure~\ref{fig_tempco_time} shows the difference caused by heating the mesh to \qty{70}{\degree C} in the time domain.
|
|
This temperature dependence stems from the resistance of the mesh's copper traces increasing with temperature, and the
|
|
dielectric properties of the FR-4 PCB substrate changing. Both dielectric constant and dissipation factor of FR-4 change
|
|
with temperature~\cite{sagarStudiesTemperatureDependent2024, hinagaThermalEffectsPCB2010}. The increase in copper
|
|
resistance causes a shift of the response curve. An increase in the dielectric dissipation factor affects the slope of
|
|
the difference in Figure~\ref{fig_tempco_time} since pulse energy is dissipated more the longer the pulse travels
|
|
through the material. A change in dielectric constant moves the response's trailing edge in time, with the pulse
|
|
propagating slightly slower at high temperature.
|
|
|
|
Since these effects are consistent with physical predictions and only reach problematic levels at large temperature
|
|
differences, it would be possible to design a classifier that is insensitive to temperature effects. Furthermore, given
|
|
the predictable, physical nature of these effects, they could also be compensated before classification in the digital
|
|
domain based on a temperature measurement.
|
|
|
|
\begin{figure}
|
|
\begin{subfigure}[t]{0.25\textwidth}
|
|
\includegraphics[width=\textwidth,trim=0 5mm 0 5mm]{fig_covar_time_drift.pdf}
|
|
\caption{Time drift (2.5h). FNR 100\% at 0.1\% FPR, CER=61\%.}
|
|
\label{fig_env_effects_time}
|
|
\end{subfigure}
|
|
\hfill
|
|
\begin{subfigure}[t]{0.35\textwidth}
|
|
\includegraphics[width=\textwidth]{fig_covar_touch_combined.pdf}
|
|
\caption{Touch sensitivity. FNR 0.0\% at 0.1\% FPR, CER=0.0\%.}
|
|
\label{fig_env_effects_touch}
|
|
\end{subfigure}
|
|
\hfill
|
|
\begin{subfigure}[t]{0.25\textwidth}
|
|
\includegraphics[width=\textwidth,trim=0 5mm 0 5mm]{fig_covar_hot_mesh.pdf}
|
|
\caption{Mesh heated (\qty{70}{\degree C}).}
|
|
\label{fig_env_effects_heat}
|
|
\end{subfigure}
|
|
\caption{Classification results of the same mesh under various environmental factors.}
|
|
\label{fig_env_effects}
|
|
\end{figure}
|
|
|
|
\begin{figure}
|
|
\centering
|
|
\includegraphics[width=1.0\textwidth]{fig_tempco_edited.pdf}
|
|
\caption[The effect of heating on a time-domain trace]{The effect of heating on a time-domain trace. One of 12
|
|
channels shown. Gray: Raw data. Black: Relative difference between hot and cool cases.}
|
|
\label{fig_tempco_time}
|
|
\end{figure}
|
|
|
|
Besides temperature, other environmental factors such as electromagnetic interference could theoretically also influence
|
|
our measurements. Although our system's equivalent-time sampling setup inherently cancels out EMI since it is not
|
|
synchronous to the sampling clock, the setup is unshielded so we verified its actual susceptibility in several
|
|
scenarios. Figure~\ref{fig_env_covar} shows the result of these measurement series. For comparison, we included several
|
|
measurements from Figure~\ref{fig_patch_large_scale}. From these figures, we can see that there are some environmental
|
|
effects, but these effects are small even when compared against a subtle attack like a patching attack with the
|
|
classification performance remaining approximately constant at 69.0\% FNR at 0.1\% FPR and a slightly reduced CER of
|
|
20\%.
|
|
|
|
\begin{figure}
|
|
\centering
|
|
% NOTE: not actually "tridelta" data, I'm just too lazy to rename these and fix up the notebook.
|
|
\includegraphics[width=0.6\textwidth]{fig_covar_patch_repeat_tridelta_all_the_data_p0.3.pdf}
|
|
\hspace*{2mm}
|
|
\caption[Classifier similarity scores of measurements in different environments]{Classifier similarity scores of
|
|
measurements in different environments, 10 measurements each. For scale, measurements from
|
|
Figure~\ref{fig_patch_large_scale} are included on the bottom/right. FNR 69.0\% at 0.1\% FPR, CER=22\%.}
|
|
\label{fig_env_covar}
|
|
\end{figure}
|
|
|
|
\subsection{Countermeasures}
|
|
|
|
As shown above, PCB security meshes can be manipulated through micro-soldering. Keeping the modifications as physically
|
|
small as possible, their impact on TDR response can potentially be kept below detection thresholds of our single-shot
|
|
baseline classifier. However, even with such a simple classifier, the entire attack would have to be carried out without
|
|
raising an alarm, e.g. by touching the mesh or contacting a trace with the soldering iron. Soldering would have to be
|
|
done using a minimal amount of solder as well as a bespoke, insulated soldering iron tip. While manufacturing such a
|
|
tool out of a material like sintered ceramic is conceivable, to our knowledge, no such tool exists on the market.
|
|
|
|
Furthermore, the actual drilling would have to happen with a dielectric drill bit, placing special attention on
|
|
evacuating conductive copper chips before they can create short circuits to nearby traces. Again, it is conceivable that
|
|
such a tool could be manufactured, but to our knowledge, such a tool is not currently available as a standard component
|
|
on the market.
|
|
|
|
Finally, any probes penetrating the mesh would have to be placed such that their presence in the vicinity of the mesh
|
|
traces does not disturb the TDR response. Modifications would have to be carried out with great care, likely using
|
|
micromanipulators or similar specialized equipment.
|
|
|
|
The PCI PTS HSM DTR standard~\cite{pcisecuritystandardscouncilPaymentCardIndustry2021} contains a useful framework for
|
|
thinking about attacker capabilities. Applying their taxonomy, our monitoring system raises the skill level required for
|
|
a patching attack from a \emph{skilled} attacker to an \emph{expert} attacker, and the equipment requirement from
|
|
\emph{standard} equipment to \emph{bespoke} equipment.
|
|
|
|
\section{Future Work}
|
|
|
|
%\paragraph{Design variants.} We found that the timing jitter of our sampling frontend is low enough to reach the
|
|
%\qty{184}{\pico\second} resolution limit of the \partno{STM32G4} \partno{HRTIM} peripheral. In our prototype, we
|
|
%implemented a -- so far unused -- adjustable power supply for the \partno{74LVC} series buffer in between the
|
|
%\partno{HRTIM} outputs and the pulse amplifier. By adjusting this buffer's power supply through one of the
|
|
%microcontroller's digital-to-analog converter (DAC) channels, we expect that it should be possible to exploit the supply
|
|
%voltage dependency of the propagation delay of \partno{74LVC} series CMOS logic to create a digitally controllable delay
|
|
%with picosecond resolution.
|
|
|
|
%\paragraph{Non-sequential sampling.} Not all parts of the reflected signal are equally sensitive to tampering atttempts.
|
|
%For instance, the reflection's trailing edge corresponds contains information on both the length of the mesh and on its
|
|
%attenuation. Instead of recording the response waveform in a linear scan, in a practical application, more relevant
|
|
%parts of the response such as this trailing edge could be scanned at a higher rate than other, less relevant parts.
|
|
%Similarly, fast scans at a coarse time resolution could be interleaved with slow scans at a finer time resolution to
|
|
%detect large changes more quickly.
|
|
\paragraph{Advanced attack classification.} While we proposed a simple baseline classifier, there is a large parameter
|
|
space for more advanced designs. For instance, a classifier could apply machine learning techniques to adapt to the
|
|
response of a particular mesh, learn its benigh behavior under temperature changes, and dynamically schedule sample
|
|
timing to focus attention on the parts of the response signal that are most susceptible to attacks. Moving from a
|
|
single-shot classifier that only observes measurements in isolation to a more advanced approach that considers the full
|
|
history of measurements during the mesh's lifetime would also likely improve performance.
|
|
|
|
\paragraph{Auxiliary applications.} The low-cost, embedded TDR frontend presented in this chapter could be used for
|
|
other monitoring tasks from tamper sensing to system health monitoring. For instance,
|
|
\textcite{vaiSecureArchitectureEmbedded2015} propose checking the integrity of a PCBA using an external Vector Network
|
|
Analyzer (VNA) attached to test points on the PCBA's Power Distribution Network (PDN). TDR can produce fingerprints
|
|
similar to a VNA and it would be interesting to measure parts of the secure subsystem other than its security mesh using
|
|
our TDR frontend.
|
|
|
|
\paragraph{Characterization of PUF-like effects.} In Section~\ref{sec-class-perf}, we have described a PUF-like effect,
|
|
where our classifier was able to distinguish supposedly identical copies of the same mesh. It would be interesting to
|
|
precisely characterize this effect and its dependence on factors such as the chosen PCB manufacturer, and to quantify if
|
|
it indeed rises to the level of a PUF in entropy and repeatability.
|
|
|
|
\section{Conclusion}
|
|
|
|
In this chapter, we presented a design for a low-cost frontend for integrity monitoring of security meshes in
|
|
applications such as HSMs based on the principles of sub-nanosecond Time Domain Reflectometry. Our design repurposes an
|
|
inexpensive HDMI redriver IC and uses a microwave clip line to form fast pulses for TDR sampling. Our design creates a
|
|
detailed fingerprint of the intact mesh's condition that not only captures the length of the mesh's traces but that can
|
|
distinguish copies of the same mesh.
|
|
|
|
We have demonstrated our prototype circuit's capability to reliably detect and distinguish a wide range of practical
|
|
attacks with no classification erros in most attack classes, and a worst-case FNR of $71.5\%$ at $0.1\%$ FPR when
|
|
detecting tiny, micro-soldered patch wires.
|
|
|
|
Compared to the state of the art, our approach enables the monitoring of larger meshes, at higher sensitivity and lower
|
|
cost. Our is easy to replicate, does not require any specialized or custom components, and unlocks high-security
|
|
applications for security meshes made using low-cost, standard PCB manufacturing processes. The improved monitoring
|
|
approach we presented in this chapter directly complements the IHSM concept we introduced in Chapter~\ref{chapter-ihsm}.
|
|
Both designs can be combined into a joint system that provides a level of tamper resistance beyond the state of the art
|
|
in both acadmic designs and in commercial offerings.
|
|
|