sharif university of technology department of computer engineering
DESCRIPTION
Sharif University of Technology Department of Computer Engineering Side Channel Attacks through Acoustic Emanations Presented by: Amir Mahdi Hosseini Monazzah Mohammad Taghi Teymoori As : Course Seminar of Hardware Security and Trust Ord. 1393. Table of Contents. Introduction. Conc. …. - PowerPoint PPT PresentationTRANSCRIPT
Sharif University of TechnologyDepartment of Computer Engineering
Side Channel Attacks through Acoustic Emanations
Presented by:
Amir Mahdi Hosseini MonazzahMohammad Taghi Teymoori
As:
Course Seminar of Hardware Security and Trust
Ord. 1393
Table of Contents
IntroductionPreliminaries
How FFT helps us!How Neural Network helps us!
Keyboard Acoustic EmanationsSimulation System Setup and ResultsConclusion and Future Work
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
1 Side Channel Attacks through Acoustic Emanations
Electromagnetic Emanations
Attacks on the security of computer systemsElectromagnetic Emanations
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
2 Side Channel Attacks through Acoustic Emanations
Optical Emanation
Attacks on the security of computer systemsOptical Emanation
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
3 Side Channel Attacks through Acoustic Emanations
Acoustic Emanation
Attacks on the security of computer systemsAcoustic Emanation
Like the mentioned attacks, works on the pattern of (acoustic) signals
This attack is inexpensive and non-invasive!Only need a simple microphone.
Example attacks already implemented onDot matrix printersKeyboard
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
4 Side Channel Attacks through Acoustic Emanations
How FFT Helps Us!
Fourier analysis converts time (or space) to frequency and vice versa.
FFT rapidly computes such transformations
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
5 Side Channel Attacks through Acoustic Emanations
How FFT Helps Us! (Cont.)
The raw sound produced by key clicks is not a good input
We need to extract relevant features of sound
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
6 Side Channel Attacks through Acoustic Emanations
How Neural Net. Helps Us! Artificial neural network is a computational model capable
of pattern recognition. Classifies feature space
Data: set of value pairs: (xt, yt), yt=g(xt);
Objective: neural network represents the input / output transformation (a function) F
Learning: learning means using a set of observations to find F which solves the task in some optimal sense
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
7 Side Channel Attacks through Acoustic Emanations
How Neural Net. Helps Us! (Cont.)
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
8 Side Channel Attacks through Acoustic Emanations
.
Inputs
Outputw2
w1
w3
wn
wn-1.
x1
x2
x3
…
xn-1
xn
y)(;
1
zHyxwzn
iii
.
Attack Properties
Based on the hypothesis that the sound of clicks might differ slightly from key to keyAlthough the clicks of different keys sound similar
to the human earThe network can be trained on one person and
then used to eavesdrop on another person typing on the same keyboard
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
9 Side Channel Attacks through Acoustic Emanations
Attack Properties (Cont.)
It is possible to train the network on one keyboard and then use it to attack another keyboard of the same typeThere is a reduction in the quality of recognition
The clicks sound different because the keys are positioned at different positions on the keyboard plate
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
10 Side Channel Attacks through Acoustic Emanations
Signals Structure
The click lasts for approximately 100 msPeak of pushing the keySilencePeak of releasing the key
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
11 Side Channel Attacks through Acoustic Emanations
Flow of Experiment
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
12 Side Channel Attacks through Acoustic Emanations
Recording the sound of pressed key
Extract the push pick information
Calculating the FFT of push pick
Importing the information to neural network
Train the neural network with various redundant information
Test the neural network with random input
Success
Neural network trained
successfully
Create more accurate
information
No Yes
Motivational Example
Capturing the voice of pressing ‘h’ keyCapturing the voice of pressing ‘z’ key
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
13 Side Channel Attacks through Acoustic Emanations
h
z
Motivational Example
Calculating the FFT of ‘h’ and ‘z’ signals
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
14 Side Channel Attacks through Acoustic Emanations
h z
Push Peak
Silence
Release Peak
Motivational Example (Cont.)
Constructing the neural network and train it!
Error Prob.=8.87e-9
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
15 Side Channel Attacks through Acoustic Emanations
MATLAB Code:…X=[Xz Xh];T=[0 1];net = newpr(X, T, 20);net = train(net, X, T);…
System Setup
Main PaperJava NNS neural network simulatorSimple PC microphone for short distances
up to 1 meterParabolic microphone for eavesdropping from a
distanceIBM keyboard S/N 0953260, P/N 32P5100
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
16 Side Channel Attacks through Acoustic Emanations
System Setup (Cont.)
This StudyMATLAB neural network simulatorSimple PC microphone for short distances
up to 1 meterA4TECH keyboard model KR-85
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
17 Side Channel Attacks through Acoustic Emanations
Results
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
18 Side Channel Attacks through Acoustic Emanations
No Mistake
!
Constant Force :Variable Force :
Alice :Bob :
Victor :
Summary
We explored acoustic emanations of keyboardLike input devices to recognize the content being
typedIn the paper the attack was also applied to
Notebook keyboardsTelephone padsATM pads
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
19 Side Channel Attacks through Acoustic Emanations
Summary (Cont.)
A sound-free (non-mechanical) keyboard is an obvious countermeasure for the attackHowever, it is neither comfortable for users nor
cheap!
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
20 Side Channel Attacks through Acoustic Emanations
Future Work
Main Idea:Improving the accuracy of the results by using the
combination of keyboard acoustic emanations and predictive text algorithms.
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
21 Side Channel Attacks through Acoustic Emanations
Recording Acoustic
Emanation of Keyboard
Training Neural
Network
Activating the Eavesdropping
System
Processing the Results with
Predictive Text Algorithms
Generating the Text Result
22 Side Channel Attacks through Acoustic Emanations
Thanks for your attention
References1. Asonov, Dmitri, and Rakesh Agrawal. "Keyboard acoustic emanations."
In IEEE Symposium on Security and Privacy, vol. 2004, pp. 3-11. 2004.2. Backes, Michael, Markus Dürmuth, Sebastian Gerling, Manfred Pinkal,
and Caroline Sporleder. "Acoustic Side-Channel Attacks on Printers." In USENIX Security Symposium, pp. 307-322. 2010.
3. Kuhn, Markus G. "Optical time-domain eavesdropping risks of CRT displays." In Security and Privacy, 2002. Proceedings. 2002 IEEE Symposium on, pp. 3-18. IEEE, 2002.
4. Vuagnoux, Martin, and Sylvain Pasini. "Compromising Electromagnetic Emanations of Wired and Wireless Keyboards." In USENIX Security Symposium, pp. 1-16. 2009.
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
23 Side Channel Attacks through Acoustic Emanations