利用激光辅助侧信道攻击从晶体管丛林中自动提取秘密
Automatic Extraction of Secrets from the Transistor Jungle using Laser-Assisted Side-Channel Attacks
摘要：
现代电子设备的安全性依赖于存储在安全硬件模块上的密钥作为信任根（RoT）。提取这些密钥会破坏整个系统的安全性。如前所示，使用芯片故障分析（FA）技术的复杂侧信道分析（SCA）攻击可以从片上存储单元提取数据。然而，由于芯片的布局是未知的对手在实践中，秘密密钥定位和逆向工程是繁重的任务。因此，硬件供应商通常认为，集成电路（IC）设计的不断增长的物理复杂性可能是对抗潜在对手的天然屏障。在这项工作中，我们提出了一种新的方法，可以提取的秘密密钥没有任何知识的IC的布局，并独立于所采用的存储器技术作为密钥存储。我们将传统上劳动密集型的逆向工程和数据提取过程自动化。为此，我们证明了使用激光辅助SCA技术从具有已知密钥的训练设备捕获的黑盒测量值可以用于配置设备，以便稍后对具有未知密钥的其他受害者设备进行密钥预测。为了展示我们方法的潜力，我们将三个不同硬件平台上的密钥作为目标，这些密钥在不同的产品中用作RoT。
英文摘要：
The security of modern electronic devices relies on secret keys stored on secure hardware modules as the root-of-trust (RoT). Extracting those keys would break the security of the entire system. As shown before, sophisticated side-channel analysis (SCA) attacks, using chip failure analysis (FA) techniques, can extract data from on-chip memory cells. However, since the chip's layout is unknown to the adversary in practice, secret key localization and reverse engineering are onerous tasks. Consequently, hardware vendors commonly believe that the ever-growing physical complexity of the integrated circuit (IC) designs can be a natural barrier against potential adversaries. In this work, we present a novel approach that can extract the secret key without any knowledge of the IC's layout, and independent from the employed memory technology as key storage. We automate the -- traditionally very labor-intensive -- reverse engineering and data extraction process. To that end, we demonstrate that black-box measurements captured using laser-assisted SCA techniques from a training device with known key can be used to profile the device for a later key prediction on other victim devices with unknown keys. To showcase the potential of our approach, we target keys on three different hardware platforms, which are utilized as RoT in different products.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
