T.G.R.M. van Leuken
Please Note
25 records found
1
Design and Verification of LUPIn
A Platform for Hardware Attacks on Encrypted USB Drives
However, replicating state-of-the-art research in hardware security can be difficult, due to the large number of components and connections. To counter this, a custom Printed Circuit Board (PCB) is presented, that aids with hardware attacks, and allows them to be executed in a reliable and reproducible way.
The PCB is targeted specifically towards hardware encrypted USB drives, and provides accessible ways to break out and interact with the target’s electrical components.
In the first part of this thesis, the design and fabrication of the platform, called LUPIn, short for Lawful Unlocking of PIN-protected USB drives, is established. The design integrates commonly-used components and functions, making it suitable for a wide range of different attacks and devices. It also incorporates robust and traceable connections to the target.
In the second part, LUPIn is verified by implementing it in a real attack. The target is a PIN-protected USB drive, which contains an IC performing key derivation. Since the debug port is not fully secured, a technique called Cold-Boot Stepping is used. This method is specifically designed to circumvent partially disabled debug ports.
To analyse the gathered data, it first must be filtered. This filtering is done using a graph-based algorithm.
In one crytographic function, an input parameter is used twice with different XOR masks. By analyzing all the filtered data, it is possible to find masked values, and use those to recover the original input value.
Concluding, a hardware tooling PCB (LUPIn) is successfully designed, assembled and tested. It proves to be a reliable platform for performing hardware attacks against encrypted USB drives. It makes development of hardware attacks simpler and less time-consuming.
In the validation of LUPIN, a real-life USB drive is successfully attacked. Thousands of RAM snapshots are collected and an algorithm is developed to filter this data. A single variable can be extracted, but it ultimately proved insufficient to fully crack the target.
...
However, replicating state-of-the-art research in hardware security can be difficult, due to the large number of components and connections. To counter this, a custom Printed Circuit Board (PCB) is presented, that aids with hardware attacks, and allows them to be executed in a reliable and reproducible way.
The PCB is targeted specifically towards hardware encrypted USB drives, and provides accessible ways to break out and interact with the target’s electrical components.
In the first part of this thesis, the design and fabrication of the platform, called LUPIn, short for Lawful Unlocking of PIN-protected USB drives, is established. The design integrates commonly-used components and functions, making it suitable for a wide range of different attacks and devices. It also incorporates robust and traceable connections to the target.
In the second part, LUPIn is verified by implementing it in a real attack. The target is a PIN-protected USB drive, which contains an IC performing key derivation. Since the debug port is not fully secured, a technique called Cold-Boot Stepping is used. This method is specifically designed to circumvent partially disabled debug ports.
To analyse the gathered data, it first must be filtered. This filtering is done using a graph-based algorithm.
In one crytographic function, an input parameter is used twice with different XOR masks. By analyzing all the filtered data, it is possible to find masked values, and use those to recover the original input value.
Concluding, a hardware tooling PCB (LUPIn) is successfully designed, assembled and tested. It proves to be a reliable platform for performing hardware attacks against encrypted USB drives. It makes development of hardware attacks simpler and less time-consuming.
In the validation of LUPIN, a real-life USB drive is successfully attacked. Thousands of RAM snapshots are collected and an algorithm is developed to filter this data. A single variable can be extracted, but it ultimately proved insufficient to fully crack the target.
A Toolchain for Streaming Dataflow Accelerator Designs for Big Data Analytics
Defining an IR for Composable Typed Streaming Dataflow Designs
In this thesis, an open-source intermediate representation (IR) is introduced which allows for the declaration of Tydi's types. The IR enables creating and connecting components with Tydi Streams as interfaces, called Streamlets. It also lets backends for synthesis and simulation retain high-level information, such as documentation. Types and Streamlets can be easily reused between multiple projects, and Tydi’s streams and type hierarchy can be used to define interface contracts, which aid collaboration when designing a larger system.
The IR codifies the rules and properties established in the Tydi specification and serves to complement computation-oriented hardware design tools with a data-centric view on interfaces. To support different backends and targets, the IR is focused on expressing interfaces, and complements behavior described by hardware description languages and other IRs. Additionally, a testing syntax for the verification of inputs and outputs against abstract streams of data, and for substituting interdependent components, is presented which allows for the specification of behavior.
To demonstrate this IR, a grammar, parser, and query system have been created, and paired with a backend targeting VHDL. ...
In this thesis, an open-source intermediate representation (IR) is introduced which allows for the declaration of Tydi's types. The IR enables creating and connecting components with Tydi Streams as interfaces, called Streamlets. It also lets backends for synthesis and simulation retain high-level information, such as documentation. Types and Streamlets can be easily reused between multiple projects, and Tydi’s streams and type hierarchy can be used to define interface contracts, which aid collaboration when designing a larger system.
The IR codifies the rules and properties established in the Tydi specification and serves to complement computation-oriented hardware design tools with a data-centric view on interfaces. To support different backends and targets, the IR is focused on expressing interfaces, and complements behavior described by hardware description languages and other IRs. Additionally, a testing syntax for the verification of inputs and outputs against abstract streams of data, and for substituting interdependent components, is presented which allows for the specification of behavior.
To demonstrate this IR, a grammar, parser, and query system have been created, and paired with a backend targeting VHDL.
Hardware-Based Methods for Memory Acquisition
Analysis and Improvements
Some server hosters facilitate cyber crime either intentionally (so called “bulletproof hosters”) or unintentionally (“bad hosters”). When dealing with uncooperative hosters during forensic investigations, it may sometimes be necessary to collect data or information on the servers without help from the owner of the server. Data within the RAM might prove insightful in, for example, determining active processes or reveal crypto graphically interesting information like encryption keys. The thesis explains key concepts within memory organization and the PCIe standard.Afterwards, it discusses several techniques for RAM acquisition and categorizes and evaluates them using a model-based approach. The thesis then dives deeper into DMA-based memory acquisition using PCIe and proposes several improvements to current DMA attacks in order to create a better memory acquisition technique. A novel memory acquisition technique is created by hot-plugging aPCIe device and skipping over the regular enumeration procedure. This techniqueal lows the memory acquisition to be executed without a reboot and provides a stealth approach to accessing the memory. ...
Some server hosters facilitate cyber crime either intentionally (so called “bulletproof hosters”) or unintentionally (“bad hosters”). When dealing with uncooperative hosters during forensic investigations, it may sometimes be necessary to collect data or information on the servers without help from the owner of the server. Data within the RAM might prove insightful in, for example, determining active processes or reveal crypto graphically interesting information like encryption keys. The thesis explains key concepts within memory organization and the PCIe standard.Afterwards, it discusses several techniques for RAM acquisition and categorizes and evaluates them using a model-based approach. The thesis then dives deeper into DMA-based memory acquisition using PCIe and proposes several improvements to current DMA attacks in order to create a better memory acquisition technique. A novel memory acquisition technique is created by hot-plugging aPCIe device and skipping over the regular enumeration procedure. This techniqueal lows the memory acquisition to be executed without a reboot and provides a stealth approach to accessing the memory.
(RRAM)-based crossbar arrays is a promising solution to implement Neural Networks (NNs) on hardware, such that they are efficient with respect to consumption of energy, memory, computational resources, and computation time. In this respect, Binary NNs (BNNs), where the weights obtain single binary values, are inherently suitable for cost-effective CIM-based NN implementations. However, RRAM devices, due to variability and reliability issues, restrict the applicability of CIM-based NN. To address this issue and towards a low-cost NN hardware realization, in this thesis, we: a) thoroughly investigate the impact of RRAM faults on the inference accuracy of RRAM-based BNNs, and b) propose three complementary fault-tolerance techniques to mitigate the impact of RRAM faults on the BNN's accuracy. These techniques are namely: a) a fault-tolerant activation function, b) a redundancy and weight range adjustment scheme and c) a retraining technique. Evaluation results compiled on the MNIST, Fashion-MNIST, and CIFAR-10 datasets demonstrate that the proposed techniques can improve the inference accuracy in the presence of RRAM faults by up to 20%, 40%, and 80%, respectively. Moreover, comparisons with certain related state-of-the-art fault-tolerance frameworks indicate that the proposed techniques yield competitive results. ...
(RRAM)-based crossbar arrays is a promising solution to implement Neural Networks (NNs) on hardware, such that they are efficient with respect to consumption of energy, memory, computational resources, and computation time. In this respect, Binary NNs (BNNs), where the weights obtain single binary values, are inherently suitable for cost-effective CIM-based NN implementations. However, RRAM devices, due to variability and reliability issues, restrict the applicability of CIM-based NN. To address this issue and towards a low-cost NN hardware realization, in this thesis, we: a) thoroughly investigate the impact of RRAM faults on the inference accuracy of RRAM-based BNNs, and b) propose three complementary fault-tolerance techniques to mitigate the impact of RRAM faults on the BNN's accuracy. These techniques are namely: a) a fault-tolerant activation function, b) a redundancy and weight range adjustment scheme and c) a retraining technique. Evaluation results compiled on the MNIST, Fashion-MNIST, and CIFAR-10 datasets demonstrate that the proposed techniques can improve the inference accuracy in the presence of RRAM faults by up to 20%, 40%, and 80%, respectively. Moreover, comparisons with certain related state-of-the-art fault-tolerance frameworks indicate that the proposed techniques yield competitive results.
This thesis aims to progress work on a novel in-memory computation architecture by contributing towards the instruction set definition and hardware implementation of the architecture. Simulation results and a proof-of-concept hardware implementation have been used to investigate the power consumption, energy consumption and latency of the designed digital circuitry. These characteristics are found to not impose any road-blocks towards progressing the architecture to new levels in future works. This thesis is part of the overarching MNEMOSENE project of which, among many others, the Delft University of Technology is a parter. ...
This thesis aims to progress work on a novel in-memory computation architecture by contributing towards the instruction set definition and hardware implementation of the architecture. Simulation results and a proof-of-concept hardware implementation have been used to investigate the power consumption, energy consumption and latency of the designed digital circuitry. These characteristics are found to not impose any road-blocks towards progressing the architecture to new levels in future works. This thesis is part of the overarching MNEMOSENE project of which, among many others, the Delft University of Technology is a parter.
Implementing a countermeasure against power analysis attacks require a thorough understanding of the attack, encryption algorithm and it's implementation on hardware and software. Conventional countermeasures for AES against power analysis techniques minimize the side-channel information by implementing masking and hiding strategies at different abstraction levels. This thesis investigates a new class of countermeasures known as "breaking" through the implementation of the Substitution Box transformation using a neural network (S-Net). The inherent properties associated with the neural network architecture is expected to remove the correlation between the power consumed and the secret key used for encryption by breaking the linear power characteristics assumed by the leakage model.
The proposed approach was implemented in software and an attack framework is used to run side-channel attacks and quantify information leakage. The effectiveness of the implemented countermeasure is measured by checking and quantifying it's security against Differential and Correlation Power Analysis, Template and Deep Learning based techniques. The results indicate that the implementation is secure against these attacks.
...
Implementing a countermeasure against power analysis attacks require a thorough understanding of the attack, encryption algorithm and it's implementation on hardware and software. Conventional countermeasures for AES against power analysis techniques minimize the side-channel information by implementing masking and hiding strategies at different abstraction levels. This thesis investigates a new class of countermeasures known as "breaking" through the implementation of the Substitution Box transformation using a neural network (S-Net). The inherent properties associated with the neural network architecture is expected to remove the correlation between the power consumed and the secret key used for encryption by breaking the linear power characteristics assumed by the leakage model.
The proposed approach was implemented in software and an attack framework is used to run side-channel attacks and quantify information leakage. The effectiveness of the implemented countermeasure is measured by checking and quantifying it's security against Differential and Correlation Power Analysis, Template and Deep Learning based techniques. The results indicate that the implementation is secure against these attacks.
These systems are controlled by means of custom real-time computing platforms containing off-the-shelf and specialized hardware components, and are optimized to keep pace with the continuing growing trend in performance requirements.
At the ASML Twinscan lithostepper's heart resides the Control Architecture Reference Model (CARM) motion control platform which manages, among others, the wafer-stage, a multiple degree of freedom module, able to position a 15 kg heavy wafer-table with nanometer accuracy at extremely high acceleration and velocity.
As the industry requirements for feature-size, overlay accuracy, and throughput keep increasing, the ASML lithosteppers, and the CARM platform in particular, should anticipate these demands by making early changes and upgrades with respect to computational performance and accuracy.
Given that the current lithostepper configurations are not capable of sustaining the anticipated updates, which requires the increase of the control loop execution frequency from 20kHz to 40kHz, an early evaluation of potential CARM High Performance Process Controller (HPPC) successors has been performed. This indicated that the NXP-Freescale T4240 processor can potentially fulfill the expected requirements, however, the evaluation lacks accuracy as it was performed on a benchmark code not reflecting the actual CARM workload. To circumvent this problem, in this thesis, we introduce a more accurate evaluation methodology, which relies on the actual motion control application running on the HPPC and is able to capture aspects as scheduling, parallelism, and processor resource usage.
To this end we develop a set of custom performance benchmarks able to emulate the CARM environment and evaluate the Freescale T4240 processor in this new context. Our results indicate that the T4240 is able to deliver enough computation power to fulfill the control loop execution frequency upscaling requirement from 20kHz to 40kHz.
Additionally, we demonstrate that due to its clustered hardware architecture one T4240 can sustain 20kHz loop execution frequency for the workload of three current HPPCs, which suggest that its utilization in current lithosteppers can be beneficial. ...
These systems are controlled by means of custom real-time computing platforms containing off-the-shelf and specialized hardware components, and are optimized to keep pace with the continuing growing trend in performance requirements.
At the ASML Twinscan lithostepper's heart resides the Control Architecture Reference Model (CARM) motion control platform which manages, among others, the wafer-stage, a multiple degree of freedom module, able to position a 15 kg heavy wafer-table with nanometer accuracy at extremely high acceleration and velocity.
As the industry requirements for feature-size, overlay accuracy, and throughput keep increasing, the ASML lithosteppers, and the CARM platform in particular, should anticipate these demands by making early changes and upgrades with respect to computational performance and accuracy.
Given that the current lithostepper configurations are not capable of sustaining the anticipated updates, which requires the increase of the control loop execution frequency from 20kHz to 40kHz, an early evaluation of potential CARM High Performance Process Controller (HPPC) successors has been performed. This indicated that the NXP-Freescale T4240 processor can potentially fulfill the expected requirements, however, the evaluation lacks accuracy as it was performed on a benchmark code not reflecting the actual CARM workload. To circumvent this problem, in this thesis, we introduce a more accurate evaluation methodology, which relies on the actual motion control application running on the HPPC and is able to capture aspects as scheduling, parallelism, and processor resource usage.
To this end we develop a set of custom performance benchmarks able to emulate the CARM environment and evaluate the Freescale T4240 processor in this new context. Our results indicate that the T4240 is able to deliver enough computation power to fulfill the control loop execution frequency upscaling requirement from 20kHz to 40kHz.
Additionally, we demonstrate that due to its clustered hardware architecture one T4240 can sustain 20kHz loop execution frequency for the workload of three current HPPCs, which suggest that its utilization in current lithosteppers can be beneficial.
digital image capturing technology allows for faster video rates, of higher quality, than has been seen before and that trend continues. With greater resolution and increased data flow there is also a need for faster and better hardware for image processing. As the trend introduced in Moore's law is slowing down, and possibly reaching saturation in the coming years, there is an ongoing search for new and different solutions in processor architecture. The trend went from single core to multi core and many core and now we are looking into other designs like memory streaming architectures and runtime reconfigurable computers. This thesis designs, implements and evaluates a programming interface for a dynamically-reconfigurable memory-streaming platform for image processing with a focus on programmability, power consumption, reconfigurability and performance. An application programming interface (API) is created to aid with new code development for the platform. The API is a library of functions that are run on an ARM processor and are used to setup, and communicate with, a stream of ρ-VEX soft processors running on a field programmable gate array (FPGA). In this research we look at other state-of-the-art solutions, for comparison and inspiration, that focus on programmability, reconfiguration and performance. The platform is reconfigurable at runtime and experiments show that it takes under 200 ms to completely reconfigure the fabric and initialize a new configuration of ρ-VEX processors. The platform is tested on a Zynq-7000 chip from Xilinx. Comparison is made between streaming architecture and a many core setup using the same amount of ρ-VEX soft processors. The results show a speedup of factor of 2 by using a single processing stream of seven cores compared with seven cores individually running the same algorithm. The result is a working fully-programmable and open-source streaming platform for the image processing domain. ...
digital image capturing technology allows for faster video rates, of higher quality, than has been seen before and that trend continues. With greater resolution and increased data flow there is also a need for faster and better hardware for image processing. As the trend introduced in Moore's law is slowing down, and possibly reaching saturation in the coming years, there is an ongoing search for new and different solutions in processor architecture. The trend went from single core to multi core and many core and now we are looking into other designs like memory streaming architectures and runtime reconfigurable computers. This thesis designs, implements and evaluates a programming interface for a dynamically-reconfigurable memory-streaming platform for image processing with a focus on programmability, power consumption, reconfigurability and performance. An application programming interface (API) is created to aid with new code development for the platform. The API is a library of functions that are run on an ARM processor and are used to setup, and communicate with, a stream of ρ-VEX soft processors running on a field programmable gate array (FPGA). In this research we look at other state-of-the-art solutions, for comparison and inspiration, that focus on programmability, reconfiguration and performance. The platform is reconfigurable at runtime and experiments show that it takes under 200 ms to completely reconfigure the fabric and initialize a new configuration of ρ-VEX processors. The platform is tested on a Zynq-7000 chip from Xilinx. Comparison is made between streaming architecture and a many core setup using the same amount of ρ-VEX soft processors. The results show a speedup of factor of 2 by using a single processing stream of seven cores compared with seven cores individually running the same algorithm. The result is a working fully-programmable and open-source streaming platform for the image processing domain.
Neuromorphic machines have been introduced relatively recently in the science community. The aim of these machines is to emulate the brain. Their low power design makes them an optimal choice for a low power wearable ECG classifier.
As features are crucial in any machine learning system, this thesis aims at proposing an energy efficient feature extraction algorithm for ECG arrhythmia classification using neuromorphic machines. The feature extraction algorithm proposed in this thesis consists of the merger of a low power feature detection and a feature selection algorithm. Also, different network configurations have been investigated to achieve classification using an LSM architecture. The resulting system can accurately cluster seven beat types, has an overall classification rate of 95.5%, and consumes an estimate of 803.62 nW. ...
Neuromorphic machines have been introduced relatively recently in the science community. The aim of these machines is to emulate the brain. Their low power design makes them an optimal choice for a low power wearable ECG classifier.
As features are crucial in any machine learning system, this thesis aims at proposing an energy efficient feature extraction algorithm for ECG arrhythmia classification using neuromorphic machines. The feature extraction algorithm proposed in this thesis consists of the merger of a low power feature detection and a feature selection algorithm. Also, different network configurations have been investigated to achieve classification using an LSM architecture. The resulting system can accurately cluster seven beat types, has an overall classification rate of 95.5%, and consumes an estimate of 803.62 nW.