![Page 1: Sharif University of Technology Department of Computer Engineering](https://reader036.vdocument.in/reader036/viewer/2022062222/568161b3550346895dd179ce/html5/thumbnails/1.jpg)
Sharif University of TechnologyDepartment of Computer Engineering
Side Channel Attacks through Acoustic Emanations
Presented by:
Amir Mahdi Hosseini MonazzahMohammad Taghi Teymoori
As:
Course Seminar of Hardware Security and Trust
Ord. 1393
![Page 2: Sharif University of Technology Department of Computer Engineering](https://reader036.vdocument.in/reader036/viewer/2022062222/568161b3550346895dd179ce/html5/thumbnails/2.jpg)
Table of Contents
IntroductionPreliminaries
How FFT helps us!How Neural Network helps us!
Keyboard Acoustic EmanationsSimulation System Setup and ResultsConclusion and Future Work
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
1 Side Channel Attacks through Acoustic Emanations
![Page 3: Sharif University of Technology Department of Computer Engineering](https://reader036.vdocument.in/reader036/viewer/2022062222/568161b3550346895dd179ce/html5/thumbnails/3.jpg)
Electromagnetic Emanations
Attacks on the security of computer systemsElectromagnetic Emanations
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
2 Side Channel Attacks through Acoustic Emanations
![Page 4: Sharif University of Technology Department of Computer Engineering](https://reader036.vdocument.in/reader036/viewer/2022062222/568161b3550346895dd179ce/html5/thumbnails/4.jpg)
Optical Emanation
Attacks on the security of computer systemsOptical Emanation
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
3 Side Channel Attacks through Acoustic Emanations
![Page 5: Sharif University of Technology Department of Computer Engineering](https://reader036.vdocument.in/reader036/viewer/2022062222/568161b3550346895dd179ce/html5/thumbnails/5.jpg)
Acoustic Emanation
Attacks on the security of computer systemsAcoustic Emanation
Like the mentioned attacks, works on the pattern of (acoustic) signals
This attack is inexpensive and non-invasive!Only need a simple microphone.
Example attacks already implemented onDot matrix printersKeyboard
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
4 Side Channel Attacks through Acoustic Emanations
![Page 6: Sharif University of Technology Department of Computer Engineering](https://reader036.vdocument.in/reader036/viewer/2022062222/568161b3550346895dd179ce/html5/thumbnails/6.jpg)
How FFT Helps Us!
Fourier analysis converts time (or space) to frequency and vice versa.
FFT rapidly computes such transformations
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
5 Side Channel Attacks through Acoustic Emanations
![Page 7: Sharif University of Technology Department of Computer Engineering](https://reader036.vdocument.in/reader036/viewer/2022062222/568161b3550346895dd179ce/html5/thumbnails/7.jpg)
How FFT Helps Us! (Cont.)
The raw sound produced by key clicks is not a good input
We need to extract relevant features of sound
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
6 Side Channel Attacks through Acoustic Emanations
![Page 8: Sharif University of Technology Department of Computer Engineering](https://reader036.vdocument.in/reader036/viewer/2022062222/568161b3550346895dd179ce/html5/thumbnails/8.jpg)
How Neural Net. Helps Us! Artificial neural network is a computational model capable
of pattern recognition. Classifies feature space
Data: set of value pairs: (xt, yt), yt=g(xt);
Objective: neural network represents the input / output transformation (a function) F
Learning: learning means using a set of observations to find F which solves the task in some optimal sense
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
7 Side Channel Attacks through Acoustic Emanations
![Page 9: Sharif University of Technology Department of Computer Engineering](https://reader036.vdocument.in/reader036/viewer/2022062222/568161b3550346895dd179ce/html5/thumbnails/9.jpg)
How Neural Net. Helps Us! (Cont.)
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
8 Side Channel Attacks through Acoustic Emanations
.
Inputs
Outputw2
w1
w3
wn
wn-1.
x1
x2
x3
…
xn-1
xn
y)(;
1
zHyxwzn
iii
.
![Page 10: Sharif University of Technology Department of Computer Engineering](https://reader036.vdocument.in/reader036/viewer/2022062222/568161b3550346895dd179ce/html5/thumbnails/10.jpg)
Attack Properties
Based on the hypothesis that the sound of clicks might differ slightly from key to keyAlthough the clicks of different keys sound similar
to the human earThe network can be trained on one person and
then used to eavesdrop on another person typing on the same keyboard
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
9 Side Channel Attacks through Acoustic Emanations
![Page 11: Sharif University of Technology Department of Computer Engineering](https://reader036.vdocument.in/reader036/viewer/2022062222/568161b3550346895dd179ce/html5/thumbnails/11.jpg)
Attack Properties (Cont.)
It is possible to train the network on one keyboard and then use it to attack another keyboard of the same typeThere is a reduction in the quality of recognition
The clicks sound different because the keys are positioned at different positions on the keyboard plate
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
10 Side Channel Attacks through Acoustic Emanations
![Page 12: Sharif University of Technology Department of Computer Engineering](https://reader036.vdocument.in/reader036/viewer/2022062222/568161b3550346895dd179ce/html5/thumbnails/12.jpg)
Signals Structure
The click lasts for approximately 100 msPeak of pushing the keySilencePeak of releasing the key
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
11 Side Channel Attacks through Acoustic Emanations
![Page 13: Sharif University of Technology Department of Computer Engineering](https://reader036.vdocument.in/reader036/viewer/2022062222/568161b3550346895dd179ce/html5/thumbnails/13.jpg)
Flow of Experiment
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
12 Side Channel Attacks through Acoustic Emanations
Recording the sound of pressed key
Extract the push pick information
Calculating the FFT of push pick
Importing the information to neural network
Train the neural network with various redundant information
Test the neural network with random input
Success
Neural network trained
successfully
Create more accurate
information
No Yes
![Page 14: Sharif University of Technology Department of Computer Engineering](https://reader036.vdocument.in/reader036/viewer/2022062222/568161b3550346895dd179ce/html5/thumbnails/14.jpg)
Motivational Example
Capturing the voice of pressing ‘h’ keyCapturing the voice of pressing ‘z’ key
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
13 Side Channel Attacks through Acoustic Emanations
h
z
![Page 15: Sharif University of Technology Department of Computer Engineering](https://reader036.vdocument.in/reader036/viewer/2022062222/568161b3550346895dd179ce/html5/thumbnails/15.jpg)
Motivational Example
Calculating the FFT of ‘h’ and ‘z’ signals
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
14 Side Channel Attacks through Acoustic Emanations
h z
Push Peak
Silence
Release Peak
![Page 16: Sharif University of Technology Department of Computer Engineering](https://reader036.vdocument.in/reader036/viewer/2022062222/568161b3550346895dd179ce/html5/thumbnails/16.jpg)
Motivational Example (Cont.)
Constructing the neural network and train it!
Error Prob.=8.87e-9
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
15 Side Channel Attacks through Acoustic Emanations
MATLAB Code:…X=[Xz Xh];T=[0 1];net = newpr(X, T, 20);net = train(net, X, T);…
![Page 17: Sharif University of Technology Department of Computer Engineering](https://reader036.vdocument.in/reader036/viewer/2022062222/568161b3550346895dd179ce/html5/thumbnails/17.jpg)
System Setup
Main PaperJava NNS neural network simulatorSimple PC microphone for short distances
up to 1 meterParabolic microphone for eavesdropping from a
distanceIBM keyboard S/N 0953260, P/N 32P5100
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
16 Side Channel Attacks through Acoustic Emanations
![Page 18: Sharif University of Technology Department of Computer Engineering](https://reader036.vdocument.in/reader036/viewer/2022062222/568161b3550346895dd179ce/html5/thumbnails/18.jpg)
System Setup (Cont.)
This StudyMATLAB neural network simulatorSimple PC microphone for short distances
up to 1 meterA4TECH keyboard model KR-85
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
17 Side Channel Attacks through Acoustic Emanations
![Page 19: Sharif University of Technology Department of Computer Engineering](https://reader036.vdocument.in/reader036/viewer/2022062222/568161b3550346895dd179ce/html5/thumbnails/19.jpg)
Results
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
18 Side Channel Attacks through Acoustic Emanations
No Mistake
!
Constant Force :Variable Force :
Alice :Bob :
Victor :
![Page 20: Sharif University of Technology Department of Computer Engineering](https://reader036.vdocument.in/reader036/viewer/2022062222/568161b3550346895dd179ce/html5/thumbnails/20.jpg)
Summary
We explored acoustic emanations of keyboardLike input devices to recognize the content being
typedIn the paper the attack was also applied to
Notebook keyboardsTelephone padsATM pads
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
19 Side Channel Attacks through Acoustic Emanations
![Page 21: Sharif University of Technology Department of Computer Engineering](https://reader036.vdocument.in/reader036/viewer/2022062222/568161b3550346895dd179ce/html5/thumbnails/21.jpg)
Summary (Cont.)
A sound-free (non-mechanical) keyboard is an obvious countermeasure for the attackHowever, it is neither comfortable for users nor
cheap!
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
20 Side Channel Attacks through Acoustic Emanations
![Page 22: Sharif University of Technology Department of Computer Engineering](https://reader036.vdocument.in/reader036/viewer/2022062222/568161b3550346895dd179ce/html5/thumbnails/22.jpg)
Future Work
Main Idea:Improving the accuracy of the results by using the
combination of keyboard acoustic emanations and predictive text algorithms.
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
21 Side Channel Attacks through Acoustic Emanations
Recording Acoustic
Emanation of Keyboard
Training Neural
Network
Activating the Eavesdropping
System
Processing the Results with
Predictive Text Algorithms
Generating the Text Result
![Page 23: Sharif University of Technology Department of Computer Engineering](https://reader036.vdocument.in/reader036/viewer/2022062222/568161b3550346895dd179ce/html5/thumbnails/23.jpg)
22 Side Channel Attacks through Acoustic Emanations
Thanks for your attention
![Page 24: Sharif University of Technology Department of Computer Engineering](https://reader036.vdocument.in/reader036/viewer/2022062222/568161b3550346895dd179ce/html5/thumbnails/24.jpg)
References1. Asonov, Dmitri, and Rakesh Agrawal. "Keyboard acoustic emanations."
In IEEE Symposium on Security and Privacy, vol. 2004, pp. 3-11. 2004.2. Backes, Michael, Markus Dürmuth, Sebastian Gerling, Manfred Pinkal,
and Caroline Sporleder. "Acoustic Side-Channel Attacks on Printers." In USENIX Security Symposium, pp. 307-322. 2010.
3. Kuhn, Markus G. "Optical time-domain eavesdropping risks of CRT displays." In Security and Privacy, 2002. Proceedings. 2002 IEEE Symposium on, pp. 3-18. IEEE, 2002.
4. Vuagnoux, Martin, and Sylvain Pasini. "Compromising Electromagnetic Emanations of Wired and Wireless Keyboards." In USENIX Security Symposium, pp. 1-16. 2009.
IntroductionPrelim
inariesK
eyboard…
Simulation
… C
onc… .
23 Side Channel Attacks through Acoustic Emanations