Chen Bangdao
email: bangdao.chen@comlab.ox.ac.uk

A W Roscoe

Mobile Electronic Identity: Securing Payment on Mobile Phones

The pervasive use of mobile phones has created a dynamic computing platform that a large percentage of the population carries routinely. There is a growing trend of integrating mobile phones with electronic identity, giving the phone the ability to prove or support the identity of the owner by containing, for example, a tuple of name, ID, photo and public key. While this helps phone owners prove who they are, it does not prove to them that they are giving their identities to intended parties. This is important in its own right for reasons of privacy and avoiding cases of "identity theft", but all the more important when identity is being provided to support the transfer of value (e.g. in mobile payment) or information. In this paper we show how Human Interactive Security Protocols can support this type of authentication in cases where PKIs are inappropriate, misunderstood or too expensive, concentrating on the case of payment.

Introduction

A report from International Telecommunication Union (ITU) earlier this year predicted that there would be 5 billion mobile phone subscribers by the end of 2010 [1]. This number is much larger than the number of personal computers (1,026 million in 2010) predicted by ITU [START_REF]Personal Computers market[END_REF]. At the same time, the computing power of mobile phones is ever improving: for example, the HTC Desire mobile phone has a 1 GHz CPU and 576 MB of RAM. In addition to the existing telephony functionalities, mobile phones, especially smart phones, are integrated with various kinds of sensors as well as powerful connectivity, typically on-board camera, GPS, motion sensor, light sensor, Bluetooth, NFC, WiFi, and 3G. Most importantly, they provide well designed convenience for people to use on a daily basis.

Such capabilities have made mobile phones a perfect electronic platform for various implementations. One of the most significant examples of these is the integration of different kinds of Electronic Identities (E-Identities), which helps reduce the number of cards and tokens a person usually carry, for example, ID card, door-access card/token, and bank card or other payment card. Such E-Identities may contain a person's name, photo, fingerprint, public/private keys, or banking/payment account details.

In Japan, the largest mobile operator NTT Docomo began deploying mobile phones containing the FeliCa contactless IC chip in 2004 [START_REF] Srivastava | Japan's ubiquitous mobile information society[END_REF]. The FeliCa contactless chip transforms mobile phones into carriers of various kinds of identities: transportation card, personal ID card and bank card.

It is reported that in 2012, banks and mobile phone operators in the Netherlands will launch a national NFC service which will enable users to use their mobile phones as payment card, tickets, coupons or membership cards [START_REF] Reuters | Dutch deal paves way for mobile payments in[END_REF].

In 2010, Chinese mobile phone operators started to implement a national mobile phone identification policy which requires users to register their mobile phone numbers under their real names and ID numbers. This will create the world's largest mobile phone identification system. At the same time, Chinese banks and mobile phone operators are working together to create a unified national platform for NFC based mobile payment service [START_REF]China Telecom, Bank of China and China UnionPay launch mobile proximity payments[END_REF].

Thus there is a huge trend of integrating mobile phones with various kinds of identities, and the most significant use may lies in mobile payment. More generally, we may consider a mobile phone as a bank/payment card once it has logged onto a banking web-site or an e-money web-site like Paypal. Almost all major banks in the US and Europe have opened a mobile banking service.

E-Identities will be communicated between individuals who may or may not know each other, and from individuals to impersonal devices such as doors, merchant tills and web-sites. It is natural to require two things: that you only give your identity to the party that you wanted to give it to, and that you do not accept an identity which you believe attaches to one party when in fact it belongs to another. You may not know in advance the name of the party to whom you are trying to connect.

PKIs are expensive to implement, not usable in cases where the name of the intended connection is not known in advance, and are frequently misused by humans. We need a cheap method of authentication, that allows authentication by context (e.g. that the device you are connecting to is the one in front of you) and which is hard for humans to misuse. We must place into the last category any protocol which simply requires the human user to press a button to say "yes", because particularly in hurried mobile scenarios humans will become distracted and complacent. So while, in mobile-to-mobile connections, it may be a valuable security feature to show each human the photograph of the other, simply expecting them to say "yes" to the obvious enquiry will give only dubious security in practice. In this paper we propose what we think is an appropriate solution to this problem.

To securely transmit an E-Identity, we firstly need to ensure authenticity as well as integrity of the E-Identity, for example, the receiver can trust that the received E-Identity originates from the correct sender. Secondly, we must protect the private E-Identity, no one except from the dedicated sender and receiver can know the details of the transmitted private E-Identity. Thirdly, we have to achieve enough pervasiveness which enables a maximum coverage of mobile phones as well as an implementation of convenient user interfaces.

To satisfy such requirements, we firstly bootstrap an authentic electronic connection between the two parties by using a Human Interactive Security Protocol (HISP), and to fulfill the second requirement, we also bootstrap a session key during the establishment of the connection. In the mean time, a careful selection of an usable HISP can guarantee the satisfaction of the third requirement. Once we have a secure connection, an automatic downloading of such E-Identities is possible, which in some payment processes is made by manually inputting. This can further reduce the amount of human effort.

HISPs are explained in Section 3, which also presents two major mobile payment scenarios; The implementation of the two scenarios is discussed in Section 4, and a general security analysis is given in Section 5.

Present-day payment solutions

At present, NFC, Bluetooth and SMS are the main channels used to carry authentication information in payment. Below we review how they are used.

NFC

NFC is based on a short range (<10cm) RF channel (13.6 MHz), which assumes that the proximity provides sufficient trust of the data transmitted over this channel. NFC is therefore regarded as a typical out-of-band (OOB) channel. OOB channels are sometimes termed as empirical channel or authentic channel, which assumes human trust but allows limited bandwidth of communication. Such channels are common in our daily life, for example, people talking, writing messages, typing words, handshaking, comparing images/words/digits.

An NFC enabled mobile phone can be used as a user-trusted touch point to display and check the received payment amount and the payee's details, as well as confirming the payment. Concrete designs of NFC-based mobile payment can be found in [START_REF] Pasquet | Secure payment with NFC mobile phone in the smarttouch project[END_REF][START_REF] Kadambi | Near-field communication-based secure mobile payment service[END_REF]. An NFC enabled mobile phone can act as a card or a terminal, and there is also a mode for peer-to-peer communication and therefore it enables peer-to-peer payment. It gives the convenience of simply touching our mobile phones to communicate securely. We also notice that NFC is currently not widely available among mobile phones, therefore it is not selected in our implementation in Section 4.

However, using proximity as the only authenticator can lead to attacks. For example, a practical NFC relay attack on mobile phones is demonstrated in [START_REF] Francis | Practical NFC Peerto-Peer Relay Attack using Mobile Phones[END_REF]. In addition, a lack of proper protocols that against man-in-the-middle (MITM) attack may make the implementations of NFC based mobile payment an easier target to MITM attackers [START_REF] Anderson | RFID and the Middleman[END_REF]. In addition, without link-level security, the transmission between two NFC devices may subject to eavesdropping and data modification [START_REF] Haselsteiner | Security in Near Field Communication[END_REF]. As we were completing this paper there was a press report of a practical MITM attack on a proximity-based car key mechanism [START_REF] Tobin | Open sesame: the magic car thieves[END_REF].

It is desirable that NFC based communication needs to be enhanced by introducing a security protocol that addresses the MITM attack [START_REF] Anderson | RFID and the Middleman[END_REF]. For example, we can bootstrap a one-time session key between two NFC devices before transmitting any sensitive data. This key is independent to any existing security and it can be used as an add-on security to NFC.

Bluetooth

Bluetooth is probably the most popular short-range communication technology available now. According to the Bluetooth Special Interest Group (SIG), in 2014 Bluetooth will be found in 70 percent of all handsets and 83 percent of all netbooks [START_REF] Bluetooth | [END_REF]. There are many implementations [START_REF] Chen | Short-range wireless technologies with mobile payments systems[END_REF][START_REF] Pradhan | Bluetooth as an Enabling Technology in Mobile Transactions[END_REF] as well as researches [START_REF] Zolfaghar | Securing Bluetooth-based payment system using honeypot[END_REF][START_REF] Gao | P2P-Paid: A Peer-to-Peer Wireless Payment System[END_REF]on using Bluetooth in mobile payments.

Bluetooth (v2.0 and older) is known to be subject to searching attack due to its reliance on an arbitrarily human selected passkey [START_REF] Jakobsson | Security weaknesses in Bluetooth[END_REF], and its pairing process generally require a long time which makes it not well user-friendly.

However, the new version Bluetooth v2.1 introduces a Secure Simple Pairing (SSP) scheme which is designed to solve the security problems and falls into the same class of HISPs that we will be studying later in this paper. But this immediately introduces a legacy problem: a communication between a v2.0 mobile phone and a v2.1 mobile phone will be eventually ended as a v2.0 communication.

Any Bluetooth which may fall short of v2.1 is too insecure to support payment. It will be possible to use v2.1 to support the same model of payment we propose in Section 3.

SMS

Telephony is regarded as a relatively secure communication technology in this paper despite some known attacks [START_REF] Mune | Hijacking Mobile Data Connections[END_REF]. The attacks against telephony network usually require much larger strength in both resources and knowledge, and therefore may not be an "economic" attack against mobile payment. SMS is therefore frequently considered secure. It worries us, however, that this security has no logical basis and is based on purely economic and subjective arguments. Without a formal and provable basis for security it seems unwise to invest heavily in a payment technology.

SMS-based mobile payment methods can be laborious and difficult to learn, and sometimes may not be as instant as other types of mobile payment [START_REF] Mallat | Exploring Consumer Adoption of Mobile Payments -A Qualitative Study[END_REF]. The best case for their use may be in long-distance communication in situations where the telephone service providers are able to give a good guarantee of authenticity.

Other solutions

In [START_REF] Mannan | Using a Personal Device to Strengthen Password Authentication from an Untrusted Computer[END_REF], the authors discussed an empirical design called MP-Auth which uses mobile phones to protect online banking. Without any use of hardware supports, it is regarded as a typical example of using PKI in mobile payment.

MP-Auth uses two public keys, one is pk B shared between the PC and the bank, the other is pk T shared between the mobile phone and the bank. These public keys are used to bootstrap a symmetric key between the mobile phone and the bank.

In addition, two more procedures are needed: one is to secure the integrity of the data received from the PC, they use an OOB method which is by displaying a hashed result1 on the mobile phone and the PC, and the user compares and selects the matching one on the mobile phone; the other is to install the correct public key pk T on the mobile phone, which they recommend to use off-line methods, for example, at a bank branch, through in-branch ATM interfaces, or using telephony.

The use of public keys like this is appropriate in cases such as electronic banking when both parties know it in advance. We do not believe it is otherwise appropriate in the world of ad hoc connections, such as when making a payment to a previously unknown payee.

The solution we will propose can simplify the above processes by considering the two connections between the mobile phone and the bank as a single insecure connection by using an OOB channel between the bank and the mobile phone (see details in Section 3).

Another novel implementation is called Cronto2 : by using the camera on the mobile phone, the user takes a photo of a square picture similar to a 2-D barcode displayed on his PC screen, and then the device translates the photo into payment details and generates a 6 digits number at the same time, once the user confirms the payment details, he enters the 6 digits number on his PC. By using the camera and the https web-site, they create an OOB channel between the user's mobile phone and the bank server. It is considered as a good example of using OOB channels in mobile payment.

Using a HISP: mixing context, human trust and security

HISPs achieve what one might at first think impossible: they bootstrap security over insecure networks such as the Internet and WiFi without any pre-existing network of secrets. They do this via the transfer of a small amount of non-secret information, usually by human users, that is authenticated by context. We hereby assume that in any mobile payment, a payer must have a way of identifying the proposed payee. This identification might arise from alreadyexisting familiarity with the payee or from the context (presence in a shop, in front of a vending machine or through an E-commerce shopping session) in which the need for the payment arises. To understand this better, think of the scenarios in which you would be willing to hand over cash: you might trust a merchant by experience or reputation, you may choose to trust him by context, or you may "trust" him to receive payment because you have already received goods or services from him. Note that there is a weaker need for trust if, as with handing over cash, you know that the damage that can be caused by an abuse of trust is strictly limited (i.e. to losing a defined amount of cash).

Even when one trusts a large organisation by reputation, one still needs to know that a payment one is making to it is within the payment one thinks one is making.

Some of these means of identification might readily create secure channels: for example one might have retained a channel used for a previous payment to a familiar payee. However some do not, and in some cases there may be a secure channel from a different device (e.g. a browser session on a PC) to the mobile phone from which we want to make payment. However in the great majority of contexts where the need for payment arises, there is an opportunity for the payee to communicate a Short Authentication String (SAS) of 6 digits (say) to the payee in such a way that the payer knows it has come from the intended payee within the intended payment. Frequently this will be via an OOB channel such as those formed by the payee looking at a till display or at the https window on a browser.

The role of a HISP is to convert well-designed SASs, and the trust that the payee has in the sender, into robust security. An SAS is much more compact than other ways in which one might attempt to authenticate a payee, and much more amenable to incorporation into protocols in a way that is not vulnerable to human mis-use.

To demonstrate our solution, we give two scenarios of mobile phone payment applications:

1. peer-to-peer (phone-to-phone): user A wants to send A's public E-Identity to user B. For example, after verifying A's public E-Identity, B can then make a payment to A3 . 2. customer-to-merchant (phone-to-server): customer C wants to send C's private E-Identity to merchant server M . For example, C uploads C's payment account details to M . This can be an online or a point-of-sale (POS) mobile payment. A mobile phone can connect to the server via: A. a PC; B. telephony or GPRS/3G.

To simplify our discussion, Scenario 2 is discussed in this section, and Scenario 1 is discussed in Section 4.1. In this section, a mobile phone is connected to the server via a PC because this can demonstrate a POS mobile payment as well as an online mobile payment.

Choosing a HISP

Over the past few years, a new family of authentication protocols that are based on human trust and interaction have been introduced. These protocols are often referred to as HISPs. They use two kinds of channels: a high bandwidth channel (denoted -→ N ) subject to the Dolev-Yao attack model [START_REF] Dolev | On the security of public key protocols[END_REF] and a low bandwidth OOB channel (denoted -→ O ). Due to its limited bandwidth, the OOB channel transmits a Short Authentication String (SAS) that is used to authenticate data exchanged over the insecure high bandwidth channel.

By comparing an SAS on an OOB channel, human users can authenticate information received from an insecure high bandwidth channel. Nguyen and Roscoe wrote an extensive survey [START_REF] Nguyen | Authentication protocols based on low-bandwidth unspoofable channels: a comparative survey[END_REF] of HISPs, comparing their cost and efficiency, of which [START_REF] Nguyen | Efficient group authentication protocol based on human interaction[END_REF][START_REF] Vaudenay | Secure Communications over Insecure Channels based on Short Authenticated Strings[END_REF][START_REF] Laur | Efficient Mutual Data Authentication Using Manually Authenticated Strings[END_REF] are good examples.

The Symmetric HCBK (SHCBK) protocol [START_REF] Nguyen | Authenticating ad hoc networks by comparison of short digests[END_REF] is a typical HISP. This, the general description, connects an arbitrary-sized group.

1. ∀A -→ N ∀A : A, IN F O A , hash(A, hk A ) 2. ∀A -→ N ∀A : hk A 3. users compare digest(hk * , {IN F O A |A ∈ G})
, where hk * is the XOR of all hk A 's for A ∈ G SHCBK has each node "publish" its name and a collection of information that it wishes to be authentically connected with that name. It also sends a hash4 of a randomly generated key hk A coupled with the name. Once it has received that information from all nodes, and therefore become committed to the set of identities, IN F O and hashed keys it will use, it publishes its previously secret hk A . The point is that by the time of this last publication, it was in fact committed to all the data used in the above protocol, even though it does not yet know all the hk A s. HCBK stands for Hash Commitment Before Knowledge. A careful security analysis of this protocol (see [START_REF] Nguyen | Authenticating ad hoc networks by comparison of short digests[END_REF], for example) demonstrates that any attacker is unable to profit from combinatorial analysis aimed at getting the SASs (i.e. digests) to agree even though nodes have difference views of the authenticated information. Good HISPs such as SHCBK therefore offer maximum security for a given amount of human effort.

Tailoring a HISP

In our payment scenario, only two parties are involved in the payment: customer and merchant. Therefore we have modified SHCBK into a pair-wise protocol which establishes a shared secret key. In the protocol, C represents the mobile phone, M represents a merchant, and U represents a user.

1. C -→ N M : ID C , IN F O C , hash(hk C , ID C ), hash(k) 2. M -→ N C : ID M , IN F O M , pk M , hash(hk M , ID M ) 3. C -→ N M : {k} pk M , hk C 4. M -→ N C : hk M 5a. M -→ O C : digest(hk C ⊕hk M , (ID C , ID M , pk M , k, hash(k), IN F O C , IN F O M ))
5b. C compares the digest value5 with its own version.

In Messages 1 and 2, we have added 6 more components, k is a session key (a random number) generated by C, it is exchanged by using the uncertified public key pk M provided by M . To avoid the intruder reflecting hk C back to C as a supposed hk M in a way that C would accept, we added ID M and ID C as two one-bit tags to distinguish the hashes generated by C and M . IN F O M , IN F O C represent other information that the actual system would require, for example, date and time, part of the payment details, etc.

Naturally, if the protocol has proceeded uninterfered with, C's and M 's values will be equal. If, however, an intruder has imposed his own values on the receivers of Messages 1-4, C and M will not agree on all four parameters. For security, what is important is that they agree on pk and k, so we will concentrate on what happens if the intruder interferes with these. What we are concerned about is the chance that the digests agree when these two values do not.

The digest function [START_REF] Nguyen | Efficient group authentication protocol based on human interaction[END_REF][START_REF] Nguyen | Authenticating ad hoc networks by comparison of short digests[END_REF] is designed so that, as hk varies, the probability that digest(hk, X) = digest(hk, Y ) for X = Y is less than , where typically is very close to 2 -b for b the number of bits in the output of digest. It must also have the property that for any fixed value d, the chance that digest(hk, X) = d as hk varies is less than . The right value of is debatable because the larger it is, the more human effort is required. To maintain an acceptable security and usability, implementors need to examine carefully about the use case and the perceived risks between the user and the merchant. A standard [START_REF]Security Requirement for Cryptographic Modules[END_REF] given by National Institute of Standards and Technology (NIST) requires that a successful guess of a secret value should be less than one in 1,000,000. Therefore, we put the number of digits of the digest value at 6 in our example6 .

The human contribution

Depending on human interaction can be dangerous because humans can become lazy, which can disable well designed security. To standardize the work flow of using a HISP, we need to clarify step (5a) and (5b).

In step (5a), when conducting online payments at home, those OOB channels U can directly interact with M are phone calls, SMSs, or using https web pages (as most of the banks/merchants are still using https service, this does not increase the risks by using it as an OOB channel). Therefore we use a dashed line to show the transmission of the digest value in Fig 1 .  To remove the user's complacency7 in step (5a), we force the user to type the digits of the received digest value into mobile phone 8 . If the comparison of digest value failed at stage (5b), a warning will be displayed on the mobile phone, and we have designed what to do next. In our implementation, we prompt the user to check if he has entered the SAS incorrectly. If so, the protocol is restarted from the beginning. If not, the payment will be aborted, because there is a distinct possibility of the intruder being present.

After a successful run of the protocol, in which C verifies the digest value received from an OOB channel, and at the same time the protocol authenticates the uncertified pk M and the one-time session key k. The user is convinced that a secure connection is established between him and M .

Demonstrating a HISP

Once the HISP above has been run, there is a channel between the payer's mobile phone and the payee that the payer trusts as both secret and authentic. We can therefore design payment methods which exploit this high-bandwidth secure channel, thereby increasing the amount of information that can be passed to (a) authenticate the identity of the payer and (b) secure the payment, for example against fraud by the payee.

We give an example of making a payment after successfully bootstrapped the session key k by using a HISP. This largely depends on the actual implementation of banks and merchants.

The session key can now be used to allow secure downloading of payment information from M . U is then asked to approve the payment by password entry. Following this, data necessary to complete the payment can be sent to M over the channel. This will vary depending on the payment protocol being used.

We recommend that an e-cheque is sent, which is encrypted under a bank key (and therefore not understandable by M ), together with all information that is not secret from M . This e-cheque might contain M 's E-Identity, date and time, amount, hash(hash(Payment Info), Account Info). M sends hash(Payment Info) to bank. An example protocol is given as below (also see M can then forward this e-cheque to a bank to get cash. In each case the fact that the payment details (amount, merchant's E-Identity, date and time) are downloaded onto the mobile phone and approved by the customer gives a considerable secondary security factor over and above that provided by HISP and password.

Reverse authentication

As we have made clear, the unique feature of a HISP is that it gives the customer confidence that he or she is connected to the desired merchant within the context of the intended payment. This both gives extra security and enables us to make the traditional security goal of authenticating the customer to merchant/bank easier and more thorough. Because it goes in the opposite direction to the main/tranditional authentication accompanying payments, we have termed it reverse authentication.

In general, by using reverse authentication, we actually put the users' safety at the center of the security design.

Implementation

In demonstration implementations of Scenario 1 and 2 discussed at the beginning of Section 3, we have used the following approaches.

A. Two mobile phones are connected via Bluetooth: the protocol will start after the Bluetooth discover-and-connect process. An e-cheque is sent to the payee from the payer. As explained at the beginning of Section 3, it can be completed in two ways, and to simplify the demonstration, we do not show a second connection to a bank or a third party. B. A mobile phone is connected to a server: because this can be remote/online or POS payment, we use a PC to act as the display on behalf of the server. To make the connection instant, the connection between the mobile phone and the server is made by initiating a data call from the server. This is slightly different from the example given in Section 3.4.

Implementation of approach A

Fig. 2: Peer-to-peer mobile payment implementation.

The photos above show the image of the users, and this is regarded as a useful supplement to the security we discussed in Section 3. By incorporating available biometrics or location information (GPS) into the protocol, we can further enhance the security and provide the user more authentic information to verify each other.

There are two important factors in determining the practicability of this implementation. One is the set-up of connection between two mobile phones, the other is the input of the digest value. In our implementation, the set-up of Bluetooth connection takes around 10 seconds, and the inputing of the 6-digit digest value takes around 15 seconds. However, if one mobile phone can display the Bluetooth address as a 2D barcode, and the other mobile phone reads it by its camera, this can reduce the time of connection set-up. A similar approach can be taken to digest values when this technology is available. This function depends on the performance of specific mobile phones because not all mobile phone cameras can easily film a clear picture of 2D barcode, for example, lowend mobile phone camera can not auto-focus and have difficulty to take clear pictures when hands are shaking. It is, however, an important aspect of our technology that this function can be performed quickly and easily by humans alone.

This is implemented on Nokia N95 and Blackberry 9000: a J2ME Midlet is programmed to run on N95, and a JAVA (on RIM) application is programmed to run on Blackberry 9000. The Bluetooth is v2.0 and the profile is no security.

Implementation of approach B

In this case, a mobile phone acts as a "trusted device", which is similar to the current Card Authentication Programme (CAP) readers. And it is required that Fig. 3: Customer-to-merchant mobile payment implementation.

the user must activate his or her online banking account or any other payment account before or during the payment process. By using reverse authentication, the merchant's E-Identity together with the payment information is downloaded onto the mobile phone, which can save the human effort of inputting those data required in most current mobile banking applications. This is implemented on Nokia N70 and a PC (acting as the server): a Symbian C++ application is programmed to run on N70, and a C++ application is programmed to run on the PC.

The cryptography functions we have applied in the applications comply with the guidance published by NIST [START_REF]Recommendation for Key Management[END_REF][START_REF]Cryptographic Algorithms and Key Sizes for Personal Identity Verification[END_REF].

Security analysis

The security attributes of a mobile payment solution usually include: confidentiality, authentication, integrity, authorization, availability and non-repudiation. Confidentiality and authentication is easily achieved by bootstrapping a secure connection prior the payment process. And the use of strong cryptographic functions protects integrity and can detect any data modification. Authorization is achieved by the verification of: A. user's password; B. user's private E-Identity (banking or payment account details). Non-repudiation is achieved by the use of an e-cheque: a bank will check and verify such an e-cheque, which contains the E-Identities of the two parties as well as the payment details. Availability is not discussed in this paper.

However, except for the above analysis, a few distinct security attributes and state-of-the-art attacks need to be considered carefully.

Phishing/Credential Harvesting

By means of disguised emails or web pages, attackers lure users to enter their credentials into a fake web form, for example, an online banking log-in form. This is a very common online attack and it is very difficult to defend once the users are tricked into such a web page.

Most mobile payments are immune to such attacks because they have independent applications that handle payment processes: the account details are input locally on the mobile phones rather than on web pages or web forms.

However, without the use of end-to-end security (for example, the use of echeque), sophisticated phishing attacks can be developed against mobile payment solutions, for example, a phishing attack can be applied against an NFC based mobile phone by modifying or replacing tags [START_REF] Madlmayr | NFC Devices: Security and Privacy[END_REF]: this can mislead the user to submit data to a wrong party. And some SMS based mobile payment solutions require users to submit their account details in clear text to a third party to log on, and this can lead to an SMS phishing attack: by luring users to submit their account details to a wrong phone number.

Our solution, which provides authentication as well as confidentiality, can ensure that the payer has approved the E-Identity of the payee, and the payee can not reuse anything from the payment. Therefore, it is resistant to the phishing attack.

Malware

Mobile malware is a serious security threat to all mobile phone based applications. A report from Kaspersky indicates that a total number of 514 pieces of mobile malware have been cataloged between 2006 and 2009 [START_REF] Gotstev | Mobile Malware Evolution: An Overview[END_REF]. Such attacks can be detected by installing mobile anti-virus software, for example, Kaspersky, F-Secure and McAfee. And it can be further mitigated by forcing users to download software from the official web sites, for example, Android and iPhone require software to be installed from their official online application shops. However, it may become more difficult to maintain a high level of security with the increasing complexity of mobile phone systems. These issues need to be considered before deciding whether to impose an upper limit on the amount of money allowed in mobile payments. Some discussions about mobile malware can be found in [START_REF] Lawton | Is It Finally Time to Worry about Mobile Malware?[END_REF][START_REF] Fleizach | Can you infect me now?: malware propagation in mobile phone networks[END_REF].

Man in the middle

Many NFC based mobile payment solutions are believed to be based on EMV [START_REF] Anderson | RFID and the Middleman[END_REF][START_REF] Sanders | From EMV to NFC: the contactless trail?[END_REF], which has been found vulnerable to MITM attacks [START_REF] Adida | Phish and Chips[END_REF]. And the NFC in itself does lack of a link-level security which may result in eavesdropping, data corruption and data modification [START_REF] Haselsteiner | Security in Near Field Communication[END_REF]. This may make them attractive to MITM attackers.

A HISP, which is designed to be resistant to MITM attack, can protect our solution against any MITM attack (see details in Section 3). However, different implementations may have different set-outs and policies, some MITM attacks need to be carefully examined, for example, the man-in-the-browser (MITB) attack and the MITS attack.

Other types of MITM attack can be found in https [START_REF] Callegati | Man-in-the-Middle Attack to the HTTPS Protocol[END_REF][START_REF] Asokan | Man-in-the-Middle in Tunnelled Authentication Protocols[END_REF], Bluetooth [START_REF] Kugler | Man in the Middle" Attacks on Bluetooth[END_REF]. [START_REF] Asokan | Man-in-the-Middle in Tunnelled Authentication Protocols[END_REF] shows a more thorough discussion of MITM attacks in tunneled authentication protocols.

Man-in-the-browser attack The MITB attack can be initiated by a MITB trojan embedded in the user's browser, for example, Zeus, Adrenaline, Sinowal and Silent Banker [START_REF]Making Sense of Man-in-the-browser Attacks[END_REF], which can then manipulate the online payment session in real-time and carry out legitimate online payments. Therefore, all the solutions that relies on or uses the security provided by web browsers to display payment details on PCs may become vulnerable to MITB attacks.

Defending against MITB attacks can be difficult. For example, the authors of MP-Auth have declared that such attacks are not addressed in their design. And a recent report [START_REF] S21sec | ZeuS Mitmo: Man-in-the-mobile[END_REF] indicates Zeus trojan is now targeting mobile phones, and it can hijack SMS communication. This will endanger many mobile payment applications that based on SMS or use SMS authentication.

Our solution, which does not depend on any specific connection or display, can resist such attacks by carefully choosing an appropriate OOB channel (see details in Section 3.3). However, the attack on SMS (if successful) does increase the cost of security, for example, we may have to use phone call to deliver the digest value in case of an online/remote payment.

Man-in-the-shop attack The merchant, the one we usually trust, can not guarantee the staff it hires are trustworthy. For example, we can find news like "Don't use cards at petrol stations" [START_REF]Don't use cards at petrol stations[END_REF] or "Restaurant workers indicted in credit card scam" [START_REF] Startribune | Metro restaurant workers indicted in credit card scam[END_REF]. Same problem arises online -merchant might lose customers' card details or its staff steal data from the server. Various incidents of card data loss are reported on the web [34]. Therefore, users should not give out their card or account details to the merchant because of the MITS attack. Such attacks can be mitigated by using the concept of e-cheque which is discussed in Section 3.4. Or the payment may has to be made by a trusted third party: a bank or a mobile wallet service provider. And the merchant will be informed and invoiced by the trusted third party.

Conclusion

We have demonstrated that using a HISP on a mobile phone can help the customer to create a secure connection which "reversely authenticates" the merchant (the payee), while keeping a low-cost on human's effort. This solution helped by the flexibility of an OOB channel which assumes no existing security can be used to defeat MITM attacks as well as to allow an efficient and secure transmission of E-Identities. And the discussion of would be useful -the balance between security and usability, which can provide more guidance to future implementations of online payment solutions based on HISPs.

  Fig 1): 6. M -→ N C : {payment amount, M's E-Identity, date and time, other details} k 7a. U checks payment amount, merchant's E-Identity, date and time, and other details displayed on C. 7b. If correct, U authorizes the payment by entering password on C. 8. C -→ N M : e-cheque E-cheques provide a way of combatting sophisticated Man-in-the-Shop (MITS) attacks which is discussed in Section 5.3.

Fig. 1 :

 1 Fig. 1: Using a HISP (demonstration of a successful run).

They use a correlation function to select the corresponding words to display based on the hashed results

http://www.cronto.com/

This can be completed by sending B's private E-Identity (payment account details) to A, or by sending B's private E-Identity together with A's public E-Identity to a trusted third party, for example, a bank.

Hash means a standard cryptographic hash function that has two main properties: collision resistance, and inversion resistance.

The digest value represents the SAS that is manually compared by humans.

The SAS here is not secret, but this provides a good analogy. In any case we believe that the use of HISPs in payments should usually be backed up by secondary security as discussed later. 6 digits happens to be the number used in the experiments reported in[START_REF] Kainda | Usability and Security of Out-Of-Band Channels in Secure Device Pairing Protocols[END_REF]

A user may simply keep pressing the OK button regardless of what displayed on the mobile phone.

[START_REF] Kainda | Usability and Security of Out-Of-Band Channels in Secure Device Pairing Protocols[END_REF] examines ways of performing this comparison and conclusively demonstrates that for security the best approach is for the customer to type the digits of the merchant's digest value into mobile phone, which then compares the two.

Acknowledgement

This project was funded in part by grants from US Office of Naval Research and the Oxford Martin School. We would like to thank Long Nguyen and Ronald Kainda for their contribution to the background of this work.


Alessandro Barenghi
email: barenghi@elet.polimi.it

Gerardo Pelosi
email: pelosi@elet.polimi.it

Yannick Teglia
email: yannick.teglia@st.com

Information Leakage Discovery Techniques to Enhance Secure Chip Design

Keywords: Side-Channel Attacks, Embedded Systems Security, Differential Power Attacks, Differential Electromagnetic Attacks

Side channel attacks analyzing both power consumption and electromagnetic (EM) radiations are a well known threat to the security of devices dealing with sensitive data. Whilst it is well known that the EM emissions of a chip represent an information leakage stronger than the overall dynamic power consumption, the actual relation between the emissions and the computations is still a subject under exploration. It is important for the chip designer to be able to distinguish which portions of the measured EM emissions are actually correlated with the sensitive information. Our technique obtains a detailed profile of the information leakage, identifying which harmonic components carry the largest part of the it on the measured signals. It may be successfully integrated in a design workflow as a post-testing feedback from the prototype chip, in the form of additional constraints aimed at reducing the local wires congestion up to a point where the emissions are no longer sufficient to conduct an attack. The analysis allows the design of ad-hoc countermeasures (shields and/or EM jammers), which do not require architectural changes to the chip. We provide a validation of the proposed technique on a commercial grade ARM Cortex-M3 based System on Chip (SoC), executing a software implementation of AES-128. The proposed approach is more efficient than a search of the whole frequency spectrum, allowing to conduct a deeper analysis with the same timing constraints.

Introduction

A significant part of the security margin provided by a cryptographic device is represented by its resistance to side channel attacks. Side channel attacks aim at disclosing the secret key of cryptographic primitives, through measuring environmental parameters during their computation. Typical environmental parameters from which it is possible to extract information relative to the values being processed are: power consumption [START_REF] Kocher | Differential Power Analysis[END_REF]10], electromagnetic radiation [START_REF] Agrawal | The EM Side-Channel(s)[END_REF]9] and execution timing [START_REF] Kocher | Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems[END_REF]. Depending on the environmental parameter being measured, the attack techniques are called respectively Differential Electromagnetic Analysis (DEMA), Differential Power Analysis (DPA) and Timing analysis (TA).

A regular Differential Electromagnetic Analysis (DEMA) or a DPA attack aims at modeling the variation of the EM emissions or the dynamic power consumption of a chip caused by the different inputs fed to the cryptographic primitive executed on it. Assuming all the values undergoing computation are known, it is possible to accurately predict the values of the aforementioned environmental parameters, but, since the value of the secret key is not known to the attacker, an alternative strategy is devised. The attacker creates a family of a-priori models, each one depending on a key hypothesis, i.e. an hypothetical value of a small part of the key. The most common way of modelling either the power consumption or the EM emissions of a digital circuit is taking into account either the Hamming Weight (HW) of the values being computed or the Hamming Distance between two subsequent values, during a part of the cryptographic primitive involving the secret key. After building the models, the attacker correlates each of the predicted results with each sample in the time series of an experimental measurement (trace) of the environmental parameter related to the execution of the targeted part of the cryptographic primitive. Since only one of the models will fit, it is possible for the attacker to deduce the right key hypothesis. In order to obtain a significant estimate of the relation between the models and the physical parameters being measured, a large number of traces are taken while employing different inputs (plaintexts or ciphertexts). Pearson's linear correlation coefficient is the most common figure of merit employed to assess the goodness of fit of the a-priori models against the actual measurements [START_REF] Brier | Correlation Power Analysis with a Leakage Model[END_REF]. Pearson's correlation coefficient turns out to be rather effective in practice since the strength of both the EM-emissions and the dynamic power consumption depend linearly on the switching activity of the underlying circuitry [8].

The analysis of EM emissions has proven an effective side channel able to yield efficient attacks [START_REF] Agrawal | The EM Side-Channel(s)[END_REF][START_REF] Gebotys | EM analysis of a Wireless Java-based PDA[END_REF][START_REF] Peeters | Power and Electromagnetic Analysis: Improved Model, Consequences and Comparisons[END_REF], although it implies a quadratic increase in the number of chip spots to be considered when compared to a DPA technique. A significant factor for this efficiency is the use of small probes with a consequent precise spatial localization of the sources of the measured signal.

The signals collected through these kinds of measurements have a high correlation with the data computed by the cryptographic primitive operation considered in the a-priori models. For example, in [START_REF] Réal | Enhancing Correlation Electromagnetic Attack Using Planar Near-Field Cartography[END_REF] the authors show that recording the emission traces over a particular spot of an FPGA programmed with an implementation of the AES block cipher (identified as the places where the S-Box function was synthesized) resulted in an effective reduction of the number of traces required. Therefore, this kind of enhancements may be expected also when the device under test is either an ASIC implementation or a general purpose CPU running the same cryptographic primitive. Moreover, an important advantage of EM analysis is the possibility to bypass common power analysis countermeasures, such as voltage pumps, and to ignore the presence of static dummy cycles inserted to rebalance timing issues.

Within this context, we propose an enhancement of the testing methodology for a circuit in order to include evaluation of the resistance to EM side channel analysis as a design step. We propose an information leakage finding algorithm aiming at recognizing which harmonic components of the measured signals actually convey the significant part of the exploitable side channel information. The proposed algorithm is faster than an exhaustive brute force sweeping the whole frequency range, while preserving the same accuracy for real world scenarios. The proposed analysis enables to design countermeasures targeted to the specific leakage pattern of the device and may be conducted also on simulated traces without any change in the procedure. At the best of the authors' knowledge, this is not currently possible due to the lack of publicly available EM emission estimation tools from any pre-prototype description of the chip. The availability of such tools would allow a pre-prototyping evaluation of the EM leakage and would allow to properly tune the post place-and-route procedure in order to mitigate the EM leakage. This may be achieved through proper routing of the wires, which represent the most EM radiating part of the circuit.

The paper is organized as follows: Sect. 2 describes how the proposed methodology integrates within the current chip design workflow. Sect. 3 explains the proposed information leakage finding algorithm and provides insights on its inner workings. Sect. 4 reports a practical validation of the proposed technique on a commercial grade Cortex-M3 SoC running an industrial grade implementation of AES-128. Finally, Sect. 5 presents our conclusions.

EMA Analysis as a Design Phase

A typical digital circuit design flow is composed of a fixed chain of stages following the high level specification of the device, in the form of a netlist description of the chip. The first steps in tackling the transformation of a netlist into an accurate blueprint of the chip are: performing a preliminary consumption analysis on the design, and adding the Built In Self Test (BIST) additional logic required to perform functional testing of the circuit. After these steps, the chip description is accurate enough to perform a full placement through the wire routing and clock tree design process. The obtained description is accurate up to a full three dimensional representation of the design at single wire level, stored in the Graphic Database System II (GDSII) common interchange format in order to control the integrated circuit photolithographic etching. After completing the whole design of the chip, a first prototype of the actual device is realized and packaged in order to be sent to the testing stage. The prototype chips are still subject to a series of compliance tests among which the Electromagnetic compatibility (EMC) ones, aimed at ascertaining that the EM radiations of the device are not strong enough to disturb the regular functioning of neighbouring devices. Electromagnetic compatibility tests are oriented to obtain a quantitative measure of the radiated energy, regardless of the information which may be carried by the wavefronts. In particular, since the die emits significantly less than the bonding wires which connect it to the package pins, its emissions are usually regarded as harmless by the common EM compatibility standards. The security testing methodology proposed in this paper can easily be integrated in the EMC compatibility testing phase, since it requires the same equipment to be performed, and does not add a prohibitive amount of time to be spent at the workbench. The target of the EM analysis is to provide a more accurate information on both the spatial location and the informative content of the EM radiation of the silicon die, through checking if there is a viable side channel for attacks. After performing the proposed analysis, it is possible for the designer to employ the gathered information for introducing countermeasures during the place-and-route (p&r) step. In particular, it is possible to either exploit the free space on the top layer of the chip, after all the p&r operations have been performed, to introduce a grounded metallic shield over the most radiative zones or to reroute partially the wires in order to avoid excessive local congestions. A further possible countermeasure is the introduction of a jamming resonator tuned on the frequencies which carry sensitive informations out of the chip. Such a resonator may be easily realised as a simple tuned wire antenna and does not need to interact with other circuits related to the chip. Thus it is possible to design it without having any concerns on the actual chip architecture thus, helping a late-stage introduction, with only a negligible area overhead.

Electromagnetic Emission Analysis

The first step in the testing methodology is to obtain a map of the intensity of the electromagnetic emissions of the silicon die. In a region of space close to the chip surface, it is possible to model the EM emitting components as a set of wires lying on the die plane. Since the radiated field of a single wire is emitted perpendicularly to direction of the current flow, a probe constituted by a wire coil placed parallel to the die surface will not be sensitive to crosstalk from nearby wires 4 , thus resulting in a reliable measure of the EM field intensity per underlying area unit. As a consequence, the parts of the chip which will be radiating more strongly are the ones characterized by a high wiring density. At the moment, the routing tools are not considering excessive wiring density as a problem because the power estimate is usually done before the wires are placed 5 . Consequently, it is possible to have strongly radiating zones which are not de-congestioned automatically by the tool, resulting in EM radiating hotspots. Round coil probes are already in use to perform EMC testing6 on packaged chips, and may be used to perform the mapping of the EM emissions as well, thus enabling equipment reuse during the testing methodology. It is possible to obtain a precise mapping of the intensity of the EM emissions of a chip per area unit during the computation of a software cryptographic primitive through recording the field emitted in a spot and repeating the measurements while sweeping with the probe all over the die surface.

A kind of chip areas which may be of particular interest to be mapped are the so-called glue logic areas: sections of the chip where the placement tool is allowed complete freedom over the component and wire layout thus possibly causing large wire skeins. Since the recorded emission signals provide the evolution of the field intensity over time, it also is possible for the designer to locate exactly which part is emitting through checking either where the chip was active during a certain time instant or which instruction is being executed on a mapped CPU. This is particularly interesting in order to focus the analysis only on the instructions of the running cryptographic primitive dealing with the secret values thus, avoiding unnecessary concerns about strong EM emissions in unrelated time instants. We point out that the EM testing is performed in a white-box environment, where the designer knows all the implementation details of the chip, including the software running on the general purpose CPU in case the algorithm is not directly implemented as an ASIC. This kind of analysis is the one warranting the strongest security on the final product, since it already assumes that the attacker is able to know all the details of the device he will target, thus considering the position of utmost advantage for him. Indeed, motivated attackers may apply hardware reverse engineering techniques in order to fully reconstruct the structure of a chip7 . After the strongest emitting spots of the chip have been located, a set of traces T is collected on top of them in order to proceed to the frequency analysis of the EM radiation. Input: δ: frequency interval on which traces are evaluated; |δ| denotes the length of the frequency interval Output: L: list of pairs (δ, n δ ), where δ is a frequency interval used to set up a filter for the measured traces, and n δ is the minimum number of filtered traces so that the correlation attack succeed with the given confidence level. Initially,

L ← ∅ 1 begin 2 if (|δ| ≥ η N threshold ) then 3 T δ Filter(δ, T ) 4 n δ CorrelationAttack(γ, T δ ) 5 L L ∪ { (δ, n δ ) } 6 if (n δ = ⊥) then

Information Finding Algorithm

In order to automatically determine the harmonic components of the recorded signals that actually carry the exploitable information, we devised an information finding method reported in Alg. 1. This computation is intended to improve the information leakage characterization by lowering the ratio between the energies E f and E t of the filtered and unfiltered version of any trace, respectively. The output of the algorithm provides all the information required to build an optimum multi-bandpass filter in order to both maximize the aforementioned energy ratio, and discard the signal components not related to the key-dependent computation. The effect on leakage estimation efficiency and precision is measured through considering the decrease in the minimum number of traces needed to carry out a successful attack with a reasonable confidence margin. The key idea is to split the spectrum in equally sized shares and filter the EM traces with a Finite Impulse Response (FIR) filter whose bandpass keeps only one share at a time. The shape of the filtering window is driven by the necessity of having a maximum flat bandpass while retaining moderate aliasing in the time domain and a reasonable roll-off in the frequency domain. Reasonable choices are either a Chebyshev (type II) window or a tapered cosine window [START_REF] Oppenheim | Discrete-Time Signal Processing[END_REF]. Subsequently, a series of attacks on the filtered traces is performed to understand which is the minimum number of measurements needed to distinguish, with a reasonable statistic confidence, the correct key hypothesis from the other ones. In order to perform a computationally efficient search in the frequency space, Alg. 1 exploits a b-ary split search strategy. The algorithm employs the previously col- lected trace set T as a test bench for the efficiency of the attacks. Let N be the number of samples in the time series of each trace or, equivalently, the number of bins of the Fast Fourier Transform (FFT) of the trace, and η the frequency interval corresponding to a single bin (η=2 f N y /N ). The frequency interval below which considering the energy of the signal is still appropriate may be defined as η N threshold , N threshold > 1, therefore the FFT bins of each trace may be thought as a sequence of B=N /N threshold slices. The algorithm receives the frequency interval δ, on which traces are evaluated, as a parameter. If the length of the frequency interval in input, |δ|, is greater or equal than η N threshold , a digital filter with such a support is applied to each trace in the set T , thus obtaining a new set of filtered traces T δ (lines 1-3). Given the set T δ , a correlation attack on the filtered traces is carried out in order to obtain either the minimum number of traces n δ (which enable to recover the secret key) or a null value ⊥ (in case of a failure of the attack) (line 4). Subsequently, the pair (δ, n δ ) is inserted in a global list L in order to record the shortest frequency intervals where the correlation attack either succeeded or failed (line 5). In case the figure of merit n δ is different from ⊥ (line 8), the interval δ is split up in b shares, with a 50% mutual overlap, (as depicted in Fig. 2) and the same procedure is recursively called on each share (lines 8-11), otherwise the algorithm returns from the call. At the end of the execution, the list L will contain both the shortest frequency intervals for which the correlation attack is able to recover the secret key and the largest frequency intervals for which the measured traces T do not provide enough information to retrieve the key. The use of a larger trace set may lead the algorithm to spot more leaking intervals than the ones obtained with less traces at the cost of a longer computation. After obtaining the output of the algorithm, the designer is able to exploit the information to design an ad-hoc filter which will remove all the harmonic components not containing any relevant informa-tion. In order to design the filter, the designer may choose to keep all the parts of the spectrum where the attack has succeeded with the number of traces at his disposal. A more restrictive choice is to keep only the harmonic components where the attack succeeds with a number of traces smaller than the one needed for an attack with unfiltered traces. The rationale behind this choice is the fact that the stricter filtering will yield a higher ratio between the energy of the filtered signal E f and the total energy of the signal E t , while retaining most of the informative content. On the other hand, discarding harmonic components which are still carrying some information, although more polluted than the original unfiltered signal, may be detrimental to the analysis, in case the leakage is not concentrated in a precise number of slices. In the following sections we will refer to the former spectrum slices as the good ones, while the latter will be indicated as the acceptable ones.

Complexity analysis

Let the running time of the algorithm be expressed as the number of Filter, and CorrelationAttack operations being executed. Assuming the shortest possible frequency interval (η N threshold ) for the application of every digital filter and correlation attack, a linear scan of the spectrum [0, B η N threshold ] would have a temporal complexity equal to Θ(B). It is possible to obtain a significant reduction of the computational effort needed to detect the leaking components of the signal through exploiting their sparsity and clustering over the whole spectrum, since real world scenarios commonly exhibits such a behaviour. The best case of Alg. 1 happens when the useful information in each measured trace is concentrated in at most 1 out of b frequency sub-intervals for each call of the recursive procedure, thus giving a computational complexity of T (B)=Ω(b log b B).

The worst case of Alg. 1 gives an upper bound to the temporal complexity T (B) and corresponds to a balanced configuration of the b-tree where at leaves level each group of sub-intervals has at least a slice where the attack succeeds. We note that the worst case condition implies the information is uniformly spread on the entire spectrum. Although this scenario is highly unlikely, it is possible to mitigate the additional computational complexity that a tree-based search algorithm would imply in such a case. A sensible trade-off is to modify the algorithm, so that the execution will halt in case the slices reach a size of b N threshold , while all the attacks are still successful. This yields a temporal complexity proportional to T (B)=O(

log b B -1 i=0 b i )=O( B-1 b-1
) at the cost of a reduction of a factor b in the precision of the analysis, while in turn avoiding the only case where the algorithm is slower than a linear scan.

The average-case running time requires a more accurate analysis. Intuitively, the information is very clustered over the entire frequency domain, thus the average running-time is expected to be much closer to the best case than to the worst case for most part of the practical cases. Let p(j) the probability of mounting a successful CorrelationAttack when considering the harmonic components of the traces in T on a single slice of the frequency spectrum: [ j η N threshold , (j + 1) η N threshold ), where j∈{0, . . . , B-1}, consequently the probability that the attack does not succeed is: 1 -p(j). Let X j be the indicator random variable associated with such an event. Hence, X j =1 if the CorrelationAttack is successful through filtering the traces on the interval [ j η N threshold , (j +1) η N threshold ), j∈{0, . . . , B-1}. Assume each call of Alg. 1 to be bound to a b-tree node, corresponding to a determined share of the frequency spectrum B. Denote with X [h-t] j t the indicator random variable associated with the event of executing a successful CorrelationAttack when considering the harmonic components of the traces in T on the frequency interval:

[ j t b h-t η N threshold , (j t + 1) b h-t η N threshold ), where j t ∈{0, . . . , B/b h-t -1}, t∈{0, . . . , h}, h= log b B . Therefore, X [h] j h , X [h-1] j h-1 , . . . , X [0]
j0 may denote the random variables (from the leaf level to the root level) associated with each node of the aforementioned b-tree, respecting the following relations:

Pr(X [h]

j h = 1) = p(j h ); j h ∈ {0, . . . , B -1} Pr(X [h-1] j h-1 = 1) = j h-1 •b+b-1 j h =j h-1 •b Pr(X [h] j h = 1); j h-1 ∈ {0, . . . , B b -1} Pr(X [h-2] j h-2 = 1) = j h-2 •b+b-1 j h-1 =j h-2 •b Pr(X [h-1] j h-1 = 1); j h-2 ∈ {0, . . . , B b 2 -1} • • • • • • Pr(X [1] j 1 = 1) = j 1 •b+b-1 j 2 =j 1 •b Pr(X [2] j 2 = 1); j 1 ∈ {0, . . . , B b h-1 -1} Pr(X [0] j0 = 1) = j 0 •b+b-1 j 1 =j 0 •b Pr(X [1] j1 = 1); j 0 ∈ {0}
The probability density function p(0), p(1), . . . in the above formula must be either estimated or modelled taking into account (i) the specific operation of the targeted cryptographic primitive, (ii) the hardware design of the target device and (iii) the physical characteristics of the environmental parameter measured by the attack. In common practical cases such as the analysis of EM emissions, the harmonic components carrying information are usually restricted to a relatively small bandwidth, since it is reasonable to assume that the resonating conductors will have reasonably close impedences. The same narrow band consideration may be made for power consumption measurements, since a synchronous circuit dissipates most of the dynamic power at each clock edge, thus resulting in a large part of the informative signal being concentrated on the same frequencies. Therefore, the probability density function p(0), p(1), . . . it is expected to be highly clustered (i.e., there are only a few p(k) =0, k∈{0, . . . , B-1}). Such a probability density function results in a low number of branches requiring a full depth exploration. Thus the proposed algorithm is faster than a linear scan in the best and average case and as fast as the linear scan in the worst case.

Experimental Validation

Workbench

The device under exam was a commercial grade Cortex-M3 based SoC 8 , endowed with on die SRAM and Flash memory, both coupled to the CPU, and USB, RS-232 and GPIO interfaces. The Cortex macrocell is synthesized together with 10+ other IP cores in a single block of glue logic, thus it is not possible to identify through optical inspection any of the components, nor to infer the placement of any of IP cores through looking at die surface with an optical microscope. In order to get as close as possible to the die surface during the measurements, the top of the chip package was removed through a combination of nitric and sulphuric acid. The device under profiling was mounted on a regular development board and affixed to a gas suspended X-Y moving table controlled by the same computer gathering the data from the oscilloscope. We chose to map the chip area by moving in 100µm steps and covering the whole zone to be mapped scanning it line by line. The equipment employed to collect all the measures was a LeCroy WavePro 7300a digital oscilloscope 9 sampling at f s,DEM A =10Gsample/s (thus resulting in a Nyquist limit for the sampled components at f N y =f s /2=5GHz), and an EM-profiling oriented Langer ICR H probe 10 made of an horizontally oriented coil with an inner diameter of 150µm, placed roughly at 0.8mm from the die surface. The signal picked up by the probe was amplified by a low noise differential amplifier and fed directly into the oscilloscope sampling channel. We targeted the load operation executed for the first look up in the S-Box. The start of the acquisition was triggered by the device under test through the use of a GPIO pin asserted by the enciphering program before the start of the execution of the first AES-128 round. All the recorded traces was obtained through averaging 16 measurements taken with the same settings and the same plaintext in order to reduce the environmental noise.

In order to provide comparative results on Alg. 1, we also conducted a power consumption measurements campaign. The measurements were collected with a LeCroy Waverunner WavePro 7100A with a maximum sampling rate of 20Gsamples/s with a LeCroy AP034 differential probe 11 connected to a 2Ω shunt inserted on the only power supply line available for the Cortex-M3 SoC. The sampling Fig. 3. Intensity of the Cortex-M3 SoC EM emissions during the time lapse when the first round key addition of AES-128 is performed. Clearer zones represent a stronger EM activity. The magnitude of the current measured by the probe has been normalized for visual enhancement rate was set to f s,DP A =5Gs/sec (f N y =2.5GHz) in order to provide a sound safety margin on the sampling of fast dynamics which may be useful during the analysis. All the signals measured are recorded in an 8-bit per sample raw format and all signal treatment on a Core i7 920 running 64-bit Linux Gentoo 2010.1.

Experimental Results

Employing the described setup, the silicon die of the device under attack was fully mapped in order to determine which components were emitting and which parts of the device logic were most active during the computation. The collected traces were processed in order to obtain a temporal sequence of maps of the emissions of the chip through adding the values of the emitted signal for 50 consecutive samples at once. The result of this preprocessing was a movie depicting the evolution of the emission during the whole running time of the AES-128, with a time accuracy of 5ns per frame. Through the knowledge of the code running on the chip, and thanks to the synchronization provided by the trigger raised by the Cortex-M3 board, it was possible to locate when the CPU was doing active computation at the beginning of the first AES round thus, obtaining the frame depicted in Fig. 3. Figure 3 depicts the amount of emitted EM radiation, measured as the intensity of the current running through the probe, where clearer colours indicate a higher EM activity. The overlain boxes point out which areas of the chip are optically recognizable. Through examining the map, it is possible to distinguish which zone of the glue logic is occupied by the Cortex-M3 core, thanks to the higher radiation caused by the ongoing switching activity. The second zone having non negligible radiating activity is the flash memory: this activity can be ascribed to the ongoing instruction fetch operation, performed in pipeline with the CPU execution phase. A possible cause of the lower radiation activity shown by the flash memory is the metal tiling added at manufacturing time to flatten the photolithographic layers which partially shields the emissions. Nonetheless, the memory electromagnetic activity is still strong enough to be measured by the probe. Placing the probe directly above the center of the hotspot (at the bottom right of the map) we collected 1100 traces of the EM emissions of the chip during the execution of the AES-128 algorithm employed in the previous phase, while changing the input plaintexts. Each of the 1100 measurements is obtained as the average of 16 measurements taken with the same plaintext in input to the cipher. In order to perform efficiency analyses also on the power consumption traces, 10000 traces of the power consumption of the same chip were collected. Each recorded trace was the result of the averaging of 64 executions of the first round of AES-128 with the same plaintext.

During the execution of Alg. 1, all the attacks were performed considering the Hamming weight of the output of one byte of the S-Box as the emission intensity model of the observable value. The branching factor of the b-tree was set to b=20 and the branching depth employed was 2. The precision achieved for the EM spectrum leakage detection was N threshold,DEM A •η DEM A =80•1.25MHz=100MHz, while for the power spectrum was N threshold,DP A •η DP A =250•0.2MHz=50MHz. Figure 4(a) shows the minimum number of traces required to successfully perform an attack on a specific slice of the spectrum (indicated on the y-axis). For the sake of clarity, all the slices where the attack does not succeed have been represented having 0 as the minimum number of traces (instead of the maximum number available for each traceset). The two vertical dashed lines, for Fig. 5. Time-wise variance of the whole traceset for EM emission before (grey) and after (black) the filtering with the filter encompassing both good and acceptable slices each picture, represent the minimum number of traces required to perform an attack keeping only a single slice of the spectrum (leftmost line) and the number of traces required to perform an attack with the unfiltered traceset (rightmost line). Both figures show that the effective part of the spectrum carrying information is rather small and, in particular, concentrated towards the low end of the spectrum. In particular, the power traces (Fig. 4(b)) show only two zones containing significant information for the analysis, while the EM spectrum (Fig. 4(a)) is richer in terms of leaking components. We note that many components of the EM spectrum contain more noise than information with respect to the unfiltered traces. Indeed, a significant number of attacks succeed with a greater number of traces than the one needed for the unfiltered ones (this is indicated by the horizontal bars exceeding the second dashed threshold).

Figure 5 depicts the variance of the whole EM trace set, computed samplewise. The black plot depicts the variance of the traces where a filter keeping both good and acceptable slices has been applied, while the grey plot depicts the variance of the unfiltered traces. It can be easily seen that evicting all the frequency components found to be unrelated by the Alg. 1 yields a time series where it is easy to spot which time instants have a large variation among different inputs, and are thus expected to leak a significant amount of information. This allows the designer to spot the other temporal locations where the information is leaked by the same physical location of the chip. After obtaining the two filters, one containing only the good slices, the other containing both the good and the acceptable ones, we compared the attacks run with both the filtered and the raw traces. In order to obtain a robust evaluation of the precision of the characterization performed, we chose the minimum number of traces necessary for the attack to succeed as a figure of merit. Since this figure is dependent on a point estimate of a statistical value (Pearson's coefficient) it is important to take into account its level of confidence in order to properly evaluate the results. This, in turn, implies that, instead of comparing the correlation coefficient of the correct key with the best guess among the wrong ones (i.e., the most likely error for an attacker), we checked when the two confidence intervals for the two values are disjoint. This occurs when the value of the estimate of the correlation coefficient for the correct key is above the one for the best mistake an attacker will make, with a statistical significance (80% and 99%, respectively, in Tab. 1) given by the width of the confidence interval. An example of the trend of the correlation coefficient when employing a growing number of traces is presented in Fig. 6. The figure depicts how the estimate of the correlation coefficients of filtered traces stabilizes with respect to the number of traces employed to perform the attack: the value of the figure of merit can be directly read (240 traces at 80% confidence level (see Fig. 6(a)) and 410 at 99% confidence level (see Fig. 6(b)). The correlation values for the DPA attacks follow the same pattern, except for the required number of traces which is higher. This may be attributed to the large amount of uncorrelated power consumption which happens on the SoC during the computation. Table 1 reports the quantitative improvements obtained through the application of the profiling technique to both DEMA and DPA. The first row of the table shows how employing the automatically designed filters improves the efficiency of the attack on a set of measurements. The eviction of the part of the frequency spectrum unrelated to the observed value reduces the number of measurements needed to detect the leakage by 22.5% employing only dense zones and by 32% employing also the sparse ones thus, enhancing the quality of the analysis of the radiated emissions. The quantity of noise removed by the filtering is particularly relevant: the ratio between the energy of the filtered signal E f and the one of the raw acquisition E t is in the -60 dB range, implying that only a small part of the radiated emission is actually correlated with the critical computation. Nonetheless, EM attacks are still able to succeed, if more resources are devoted to take a large number of measurements from the chip. The second row of the table reports the gains when the automatic filtering design methodology is applied to power traces. The results suggest that also the correlation analysis on the power consumption signals benefits from employing proper filtering on the measured signals. The number of measurements is reduced by an order of magnitude, coherently with the fact that the power traces, taking into account the consumption of the whole chip, are expected to contain more content unrelated to the attack. In both cases, the enhancement in the efficiency allows the designer to take into account the real entity of the threat, which would have been masked by the environmental and systematic noise. One particular effect is that, while DPA attacks benefit from employing only harmonic components where the obtained information is dense, DEMA attacks perform better when including also sparse ones. This may be ascribed to the fact that the leakage in power consumption is concentrated in a few harmonic components [START_REF] Barenghi | Improving First Order Differential Power Attacks Through Digital Signal Processing[END_REF]. The running time of the algorithm was sensibly lower than the linear scanning of the spectrum for both cases. In particular, the analysis of the EM traces required only 20 attacks at the first level and 40 at the second level of the b-tree (thus 60 calls to CorrelationAttack instead of 400), while the analysis of the power traces required 20 attacks at the first level and 20 at the second (40 calls versus the 400 needed for a linear scan). Taking into account the time for a single attack the overall running time of Alg. 1 was of 2.5 hours (against a 16.6 for a full linear scan) for the power consumption profiling and of 19 minutes for the EM profiling (against a 3 hours and 10 minutes long linear scan).

Conclusion

In this work we proposed a new technique able to obtain a characterization of the information of the EM leakage and demonstrated its viability employing an ARM Cortex-M3 chip running an implementation of AES-128. The proposed algorithm is able to obtain a precise characterization of the harmonic components of the side channel measurements (up to a 1/400th of the measured bandwidth in our experiments), within an acceptable time frame on a single desktop. We note that the information obtained from the spatial and frequency profiling of the EM traces allows the designer to introduce ad-hoc countermeasures to the information leakage. This results either in savings in terms of shielded area or in the introduction of non-architecturally invasive active countermeasures into the chip to selectively choke up the EM emitted information. As future developments for reinforcing the security of cryptographic devices, through employing signal processing techniques, we plan to investigate topics about blind source separation (BSS) methods [START_REF] Le | How can Signal Processing benefit Side Channel Attacks? In: Workshop on Signal Processing Applications for Public Security and Forensics[END_REF]. After a proper mapping of the targeted device, these techniques provide an interesting tool to separate the signal components bound to the cryptographic primitive computation from the signals emitetted from other active parts of the device.

Fig. 1 .

 1 Fig. 1. Description of a typical digital chip design flow. The proposed EM analysis stage is highlighted in gray

Algorithm 1 :

 1 Leaked Information Finding Algorithm Globals: T : set of traces, b: branching factor, γ: confidence level of the correlation attack

9 {δ 0

 90 , . . . , δ b-1 } SplitUp(δ) 10 for i from 0 to b-1 do 11 Call Algorithm 1(δi)

Fig. 2 .

 2 Fig. 2. Overlapping windows generated by the search algorithm. This example depicts the amplitude of four tapered cosine windows, as it could happen on the first run of the algorithm with b = 4

Fig. 4 .

 4 Fig. 4. Minimum number of traces necessary to perform an attack in Alg. 1 considering a single slice. Figure (a) depicts the results for the EM traceset, while Fig.(b) for the power consumption traceset. The leftmost dashed line indicates the least number of traces employed per slice, the rightmost the number of traces necessary with the unfiltered traces. The omitted part of the spectrum has no slices where the attack succeeds

Fig. 6 .

 6 Fig. 6. Correlation analysis of filtered EM traces assuming a confidence level γ=80% (a), and γ=99% (b)

Table 1 .

 1 Comparison among the efficiency of the filter construction technique on EM and power consumption traces

		Statistical	No Filtering	Good Slices	Accept.+Good Slices
		Confidence Min. Num. Min. Num. E f /E t of Traces of Traces	Min. Num. E f /E t of Traces
	DEMA	80% 99%	310 660	240 400	-63.8 dB	210 410	-61.6 dB
	DPA	80% 99%	5800 5800	300 800	-62.4 dB	450 800	-55.8 dB

In a circular wire coil, placed parallel to the surface of the chip, the induced voltage drop at the ends of the wire is proportional derivative of the sensed magnetic flux (∆V =-dφ dt )

Cadence Design Systems, Inc., Physical Prototyping-Key to Nanometer SoC Chip Design, Whitepaper. Dec. 2010, http://www.cadence.com

International Electrotechnical Commission, IEC/TS 61967-3 ed1.0, ISO-Standard, Dec. 2010, http://webstore.iec.ch/webstore/webstore.nsf/artnum/035659

Chipworks, Report Library & Technical Competitive Analysis, Technical Report, Dec. 2010, http://www.chipworks.com/Report_search.aspx