Systems, methods, and apparatuses for intrusion detection and analytics using power characteristics such as side-channel information collection

• US 10,970,387 B2
• Filed: 12/13/2018
• Issued: 04/06/2021
• Est. Priority Date: 05/22/2015
• Status: Active Grant

• Current Assignee: Power Fingerprinting Inc.
• Original Assignee: Power Fingerprinting Inc.
• Inventors: Aguayo Gonzalez, Carlos R., Reed, Jeffrey H., Chen, Steven C.
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US16/219,438
• Publication Number:
  US 20190197237A1
• Time in Patent Office: 845 Days
• CPC Class Codes: G01R 1/0408 Test fixtures or contact fields; Connectors or connecting adaptors; Test clips; Test sockets G01R1/067 takes precedence; mass production testing systems G01R31/59; testing of connections G01R31/66; for testing printed circuit boards G01R31/2808
• CPC Class Codes: G01R 21/00 Arrangements for measuring electric power or power factor G01R7/12 takes precedence
• CPC Class Codes: G01R 31/2832 Specific tests of electronic circuits not provided for elsewhere G01R31/2801, G01R31/316 take precedence
• CPC Class Codes: G01R 31/2886 Features relating to contacting the IC under test, e.g. probe heads; chucks G01R31/2865 takes precedence, test connections, e.g. test sockets, or probes per se, G01R1/04 or G01R1/06
• CPC Class Codes: G01R 31/2887 involving moving the probe head or the IC under test; docking stations moving single probes G01R1/06705; moving individual probes in multiple probes G01R1/07392
• CPC Class Codes: G01R 31/2891 related to sensing or controlling of force, position, temperature G01R31/2874 takes precedence; sensing of force G01L; sensing of position G01B, G01D; sensing of temperature G01K; controlling in general G05
• CPC Class Codes: G01R 31/2893 Handling, conveying or loading, e.g. belts, boats, vacuum fingers G01R31/2867 takes precedence; handling semiconductor devices or wafers during manufacture or treatment H01L21/67
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/755 with measures against power attack
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system

Abstract

Some embodiments described herein include a system that collects and learns reference side-channel normal activity, process it to reveal key features, compares subsequent collected data and processed data for anomalous behavior, and reports such behavior to a management center where this information is displayed and predefine actions can be executed when anomalous behavior is observed. In some instances, a physical side channel (e.g. and indirect measure of program execution such as power consumption or electromagnetic emissions and other physical signals) can be used to assess the execution status in a processor or digital circuit using an external monitor and detect, with extreme accuracy, when an unauthorized execution has managed to disrupt the normal operation of a target system (e.g., a computer system, etc.).

Claims

1. An apparatus, comprising:

a power management circuit configured to be operatively coupled to a processor, the power management circuit configured to send to the processor a first power signal and a second power signal that is generated by varying the first power signal based on a regulatory function of the power management circuit, the regulatory function of the power management circuit including a set of policies to regulate the first power signal within operating parameters of the power management circuit;

a sensor in communication with or included within at least one of the power management circuit or the processor, the sensor configured to detect a first side-channel information of the processor based on the first power signal and a second side-channel information of the processor that is based on the second power signal; and

a notification circuit in communication with the sensor, the notification circuit configured to send a notification signal indicative of an anomaly of the processor when the anomaly of the processor is detected based on at least one of the first side-channel information or the second side-channel information.

2. The apparatus of claim 1, wherein the regulatory function of the power management circuit is voltage scaling, a voltage of the first power signal differs from a voltage of the second power signal, the anomaly of the processor is detected based on at least one of the first side-channel information or the second side-channel information relative to a reference.

3. The apparatus of claim 1, wherein the regulatory function of the power management circuit is frequency scaling, a frequency of the first power signal differs from a frequency of the second power signal, the anomaly of the processor is detected based on at least one of the first side-channel information or the second side-channel information relative to a reference.

4. The apparatus of claim 1, wherein the regulatory function of the power management circuit is frequency scaling, a frequency of the first power signal differs from a frequency of the second power signal, the anomaly of the processor is detected based on a reference that has been time scaled relative to the frequency of the second power signal.

5. The apparatus of claim 1, wherein the regulatory function of the power management circuit is power adjustment, a power of the first power signal differs from a power of the second power signal, the anomaly of the processor is detected based on a change in heat generated to at least one of the power management circuit or the processor based on the first power signal and the second power signal.

6. The apparatus of claim 1, wherein the regulatory function of the power management circuit is power adjustment, a power of the first power signal differs from a power of the second power signal, the anomaly of the processor is detected based on a disruption to the regulatory function of the power management circuit due to one of the first power signal or the second power signal that has a higher power than another of the first power signal or the second power signal.

7. The apparatus of claim 1, wherein the anomaly of the processor is detected based on at least one of the first side-channel information or the second side-channel information relative to a reference that is calibrated for the regulatory function and the second power signal.

8. The apparatus of claim 1, wherein the anomaly of the processor is detected based on at least one of the first side-channel information or the second side-channel information relative to a reference that has been transformed based on the regulatory function.

9. The apparatus of claim 1, wherein:

the power management circuit is configured to be operatively coupled to an electronic device operatively coupled to the processor via a Universal Serial Bus (USB) connection;

the sensor is configured to detect a third side-channel information of the electronic device indicating anomalous behavior of the electronic device.

10. The apparatus of claim 1, wherein:

the power management circuit is included in a power management chip configured to adjust a level of power provided to the processor.

11. The apparatus of claim 1, wherein:

the power management circuit includes or is operatively coupled to an analog-to-digital converter (ADC), the ADC configured to convert the first side-channel information from an analog signal to a digital signal.

12. The apparatus of claim 1, wherein:

the power management circuit includes or is operatively coupled to an analog-to-digital converter (ADC), the power management circuit and the ADC are included in a power management chip configured to adjust power to the processor, the ADC configured to convert the first side-channel information from an analog signal to a digital signal.

13. The apparatus of claim 1, wherein the regulatory function of the power management circuit is based on a current input.

14. A method, comprising:

sending, from a power management circuit to a processor, a first power signal and a second power signal that is generated by varying the first power signal based on a regulatory function of the power management circuit, the regulatory function of the power management circuit including a set of policies to regulate the first power signal within operating parameters of the power management circuit;

receiving a first side-channel information of the processor based on the first power signal and a second side-channel information of the processor that is based on the second power signal; and

sending a notification signal indicative of an anomaly of the processor when the anomaly of the processor is detected based on at least one of the first side-channel information or the second side-channel information.

15. The method of claim 14, wherein the regulatory function of the power management circuit is voltage scaling, a voltage of the first power signal differs from a voltage of the second power signal, the anomaly of the processor is detected based on at least one of the first side-channel information or the second side-channel information relative to a reference.

16. The method of claim 14, wherein the regulatory function of the power management circuit is frequency scaling, a frequency of the first power signal differs from a frequency of the second power signal, the anomaly of the processor is detected based on at least one of the first side-channel information or the second side-channel information relative to a reference.

17. The method of claim 14, wherein the regulatory function of the power management circuit is frequency scaling, a frequency of the first power signal differs from a frequency of the second power signal, the anomaly of the processor is detected based on a reference that has been time scaled relative to the frequency of the second power signal.

18. The method of claim 14, wherein the regulatory function of the power management circuit is power adjustment, a power of the first power signal differs from a power of the second power signal, the anomaly of the processor is detected based on a change in heat generated to at least one of the power management circuit or the processor based on the first power signal and the second power signal.

19. The method of claim 14, wherein the regulatory function of the power management circuit is power adjustment, a power of the first power signal differs from a power of the second power signal, the anomaly of the processor is detected based on a disruption to the regulatory function of the power management circuit due to one of the first power signal or the second power signal that has a higher power than another of the first power signal or the second power signal.

20. The method of claim 14, wherein the regulatory function of the power management circuit is based on a current input.

21. An apparatus, comprising:

a power management circuit configured to be operatively coupled to a processor and adjust a level of power provided to the processor,

the power management circuit configured to send to the processor a first power signal and a second power signal that is generated by varying the first power signal and based on a regulatory function of the power management circuit, the regulatory function of the power management circuit including a set of policies to regulate the first power signal within operating parameters of the power management circuit,

the power management circuit in communication with a sensor configured to detect a first side-channel information of the processor based on the first power signal and a second side-channel information of the processor that is based on the second power signal; and

a notification circuit in communication with the sensor, the notification circuit configured to send a notification signal indicative of an anomaly of the processor when the anomaly of the processor is detected based on at least one of the first side-channel information or the second side-channel information.