Using EM Side-Channels Near a Bluetooth Server Implementation to Monitor Bit-Level Leakages in BLE Communications Channels

Description

Dataset for figures in the publication, "Using EM Side-Channels Near a Bluetooth Server Implementation to Monitor Bit-Level Leakages in BLE Communications Channels," by V.V Iyer and J.D. Rezac (GLSVLSI 2024). The abstract for this publication is as follows: Unintentional electromagnetic (EM) emanations from general purpose embedded systems have been comprehensively studied as data recovery and monitoring tools for hardware security. While the potency of these physical side channels has been repeatedly demonstrated on embedded cryptosystems and microprocessors, limited work has been performed on judging their effectiveness in surveilling wireless communication between interconnected devices. This work uses EM side channels near a Bluetooth Low Energy (BLE) server to recover data received from a client. The method uses near-field EM scans to isolate on-chip locations susceptible to data leakage. At these locations, information leakage from a p-bit data value is partitioned into p bit-wise components. These components are individually and independently classified using SVMs trained on a novel side-channel metric. Only O(p^2) measurements and p bit-wise classifications are needed to identify which of the 2^p possible values has been received. The performance of the method is evaluated using the average recovery rate across bits in several unknown test data packets?a recovery rate of ? 96% was observed when the method was tested on a commercial BLE module.

Resources

Name Format Description Link
8 Residual signals for bit 1 training. First column is frequency (MHz) and remaining are residual voltages (mV). https://data.nist.gov/od/ds/mds2-3176/Fig6b.csv
8 T-stat values on residual training signals. First column is frequency (MHz). Second is unitless t-stat. https://data.nist.gov/od/ds/mds2-3176/Fig6c.csv
8 Distribution of residual functions across the 2 frequencies with the most prominent t-value. Comes from test data whose true bit is 1. https://data.nist.gov/od/ds/mds2-3176/Fig6d_test1.csv
8 Fig6d_test0.csv https://data.nist.gov/od/ds/ark:/88434/mds2-3176/Fig6d_test0.csv
47 https://data.nist.gov/od/ds/ark:/88434/mds2-3176/Fig6d_test0.csv.sha256
8 Fig6d_test1.csv https://data.nist.gov/od/ds/ark:/88434/mds2-3176/Fig6d_test1.csv
47 https://data.nist.gov/od/ds/ark:/88434/mds2-3176/Fig6d_test1.csv.sha256
47 https://data.nist.gov/od/ds/ark:/88434/mds2-3176/Fig6d_train1.csv.sha256
8 Spatial map of information leakage. Columns indicate different horizontal spatial locations. Rows indicate different vertical spatial locations. https://data.nist.gov/od/ds/mds2-3176/Fig4d.csv
8 Distribution of residual functions across the 2 frequencies with the most prominent t-value. Comes from training data whose true bit is 0. https://data.nist.gov/od/ds/mds2-3176/Fig6d_train0.csv
47 https://data.nist.gov/od/ds/ark:/88434/mds2-3176/Fig6d_train0.csv.sha256
8 Fig6d_train1.csv https://data.nist.gov/od/ds/ark:/88434/mds2-3176/Fig6d_train1.csv
47 3176_README.txt https://data.nist.gov/od/ds/ark:/88434/mds2-3176/3176_README.txt
47 https://data.nist.gov/od/ds/ark:/88434/mds2-3176/3176_README.txt.sha256
8 Fig6d_train0.csv https://data.nist.gov/od/ds/ark:/88434/mds2-3176/Fig6d_train0.csv
8 EM spatial map for value with hamming weight 8 at a time instance of maximum leakage. Different columns correspond to different horizontal spatial values. Different rows correspond to different vertical spatial values. https://data.nist.gov/od/ds/mds2-3176/Fig4c.csv
8 Hamming weight dictionary signals. First column is frequency (MHz). Remaining columns are measured voltages (mV) for different hamming weights, and a test hamming weight, respectively. https://data.nist.gov/od/ds/mds2-3176/Fig6a.csv
8 Snippet of the decode window within the leakage interval. First column is time (ns). Second column is leakage voltage (mV) for a signal with hamming weight 0. Third is the same with hamming weight 8. https://data.nist.gov/od/ds/mds2-3176/Fig4b.csv
8 Snippet of the decode window for the write operation. First column is time (microseconds). Second column is measured leakage voltage (mV) for a signal with hamming weight 0. Third column is the same with hamming weight 8. https://data.nist.gov/od/ds/mds2-3176/Fig4a.csv

Tags

  • near-field-metrology-side-channel-security-ble-communication-wireless-systems

Topics

Categories