CERG Seminars are held in the Engineering Building on the GMU Fairfax campus unless noted otherwise. Parking is available in the Sandy Creek parking deck near the Engineering Building. Directions to the campus can be found here. The seminar talks are usually 45 to 60 minutes long and are open to the public. If you wish to be notified about future seminars, please send an e-mail to Jens-Peter Kaps.
[Current] [2020] [2019] [2018] [2017] [2016] [2015] [2014] [2013] [2012] [2011] [2010] [2009] [2008] [2007]
Cédric Marchand, Hubert Curien Laboratory, University of Lyon, Saint-Etienne, France
Date: Wednesday, September 23rd, 1:30 PM - 2:30 PM
Location: Engineering Building, Room 3507
For many years, the microelectronic industry has been facing an increase in the costs of integrated circuits (ICs) production. This effect is due to the increasing complexity of systems and the expensive technology refinement. As a result, this industry has seen relocation of its production facilities and a sharp increase in the number of fabless companies (companies which do not produce ICs themselves). In addition, the time-to-market is increasingly tight. Thus, ICs manufactured today are produced with a high amount of added value in a highly competitive industry! All these changes have made electronic devices the target of counterfeiting, illegal cloning, theft and malicious hardware insertion (such as hardware trojans). The counterfeiting of ICs has become a major problem in recent years. For instance, the number of counterfeit electronic circuits seized by the U.S. Customs between 2001 and 2011 has increased around 700 times. Between 2007 and 2010, the U.S. Customs confiscated 5.6 million counterfeit electronic products. Overall, counterfeiting is estimated to account for about 7% of the semiconductor market, which represents a loss of around $22 billion for the lawful industry in 2014.
Designing salutary hardware (salware) is a way to protect IPs against these emerging threats. Salware is a small piece of hardware, hardly detectable and hard to circumvent (from the attacker's point of view), inserted in an integrated circuit or an IP, used to provide intellectual property information and/or to remotely activate the integrated circuit or IP after manufacturing and/or during authorized use. This PhD study is devoted to the investigation of three different SALWARE mechanisms: IP Watermarking, Physical Unclonable Functions (PUFs), and ultra-lightweight cryptography. (Full Announcement)
Thomas Eisenbarth, Assistant Professor, Worcester Polytechnic Institute, Worcester, MA
Date: Tuesday, August 11th, 3:00 PM - 4:00 PM
Location: Engineering Building, Room 3507
Cloud computing services are more popular than ever with their ease of access, low cost and real-time scalability. Security of the cloud computing infrastructure relies on logical isolation between virtual machines through sandboxing. However, isolation is not perfect, and side channels caused by the CPU's microarchitecture can result in information leakage across virtual machines. For instance, cache attacks that exploit access time variations when retrieving data from the cache or the memory are a powerful tool to extract information from a co-located virtual machine. In this talk, we present several methods of how to exploit cache-based side channels across VM boundaries. It will be shown how the Flush+Reload and Prime and Probe attack techniques can be applied to extract sensitive information from a co-located VM across cores, including information about used cryptographic libraries, but also more fine-grain information such as AES keys. Potential mitigation techniques to prevent these kind of attacks are also discussed. This talk is based on joint work with Gorka Irazoqui, Mehmet Sinn Inci, Berk Gulmezoglu and Berk Sunar. (Full Announcement)
Francesco Regazzoni, ALaRI Institute of University of Lugano, Switzerland
Date: Monday, May 11th, 3:00 PM - 4:00 PM
Location: Engineering Building, Room 3507
Physical attacks exploit the physical weaknesses of cryptographic devices to reveal the secret information stored on them. Countermeasures against these attacks are often considered only in the later stages of the full design flow, and applied manually by designers with strong security expertise. This approach, however, negatively affects the robustness, the cost, and the production time of secure devices. In view of this increasingly relevant problem, it is crucial to address the design challenges associated with the proliferation of physical attacks, developing a methodology to automate the design and the verification of secure embedded systems. This talk focuses on one type of physical attacks, the differential power analysis (DPA), and presents the design and the implementation of the infrastructure needed to enable the automatic application and verification of DPA countermeasures. (Full Announcement)
ECE 746 Advanced Cryptography, Project Presentations
Date: Tuesday, May 1st, 4:30 PM - 8:00 PM
Location: Engineering Building, Room 3507
Join us for an evening of exciting presentations by ECE 746 students. The exact schedule is posted here. William Diehl, Ahmed Ferozpuri, Sangamitra Katamreddy, and Upendarreddy Mamidi of our research group will be presenting. Please come over to cheer them on!
Urvi Tank, MS CpE Scholarly Paper
Date: Thursday, February 12th, 3:00 PM - 4:00 PM
Location: Engineering Building, Room 4801
Cache based side channel attacks are considered a powerful attack in cloud and non-cloud environments. Several cache based attacks have been performed on various cryptographic algorithms to retrieve secret data such as key. In a non-cloud or local environment an attacker can retrieve a key either by measuring execution time of the ciphers (time-driven attack), by manipulating the state of caches (access-driven attack), or by obtaining a profile of cache activities (trace-driven attack) on a single-user server. In contrast, in the cloud environment, attacker and victim can have each their own VM however the VMs can share resources. This scenario enables a malicious tenant to steal crypto keys from victims using time or trace driven cache measurement techniques. This paper analyzes the current state of cache based side-channel vulnerabilities in cloud environments, and possible solutions.
Rajesh Velegalati, PhD ECE Defense of Doctoral Dissertation
Date: Monday, February 2nd, 10:00 AM - 11:00 AM
Location: Engineering Building, Room 3507
Physical implementations of encryption algorithms on any hardware device are proven to leak secret information in the form of so called Side channels and also during sudden change in operational characteristics of the crypto-device i.e. via Fault Injection. The research in this area shows that Side Channel Analysis (SCA) attacks and Fault Injection (FI) pose a major threat because the physical implementations of the cryptographic devices are difficult to control and often result in unintended leakage of information. Generally, all hardware implementations of cryptographic algorithms are assumed to be vulnerable to SCA and FI attacks, if there are no special precautions in the implementation. Differential Power Analysis (DPA) attacks are an efficient form of SCA attacks. Several countermeasures against DPA were proposed, however development of countermeasures which makes use of FPGA features are at an infancy stage. As a part of this dissertation we developed a new countermeasure against DPA which has low-area overhead and makes use of FPGA intrinsic features. In order to validate the new countermeasure proposed, we developed an open-source tool called Flexible Opensource workBench fOr Sidechannel analysis - FOBOS. FOBOS can not only be used for research, but also for educational purposes. We propose a methodology for detecting glitches in hardware implementations on FPGAs using a delay based sampling technique. We use this methodology to validate that our proposed countermeasure is free from early evaluation effects. (Full Announcement)
Rajesh Velegalati, ECE PhD Seminar
Date: Monday, January 26th, 4:00 PM - 5:00 PM
Location: Engineering Building, Room 3507
Historically, cryptographic modules were embedded in Hardware Security Modules (HSMs) and secured by placing them in a physically secure environment. Nowadays, tokens are becoming more ubiquitous outside of secure environments: smart cards, and various USB and standalone tokens offer cryptographic services. Even though these devices protect confidential information using cryptographic algorithms that withstand rigorous cryptanalytic attacks, an adversary that has physical access to a device can obtain secret information by modifying the behavior of the chip through hardware attacks such as Fault Injection. These faults can be induced by over- clocking, introducing transients in power and clock lines (power and clock glitches) or through optical radiations. The setup required to induce these faults is invasive in nature. The power and clock lines to the target are to be isolated to induce faults, which may not be possible in real-world cases. Although fault injection through optical radiation can be very precise in time and space, the die of the chip needs to exposed through decapping.
A new class of fault attacks was introduced, which uses an electro magnetic field to induce faults in the target device. The Electro Magnetic Fault Injection (EMFI) perturbation is effective and non-invasive in nature. In this presentation, I will talk about the background, methodology and experimental setup required to conduct EMFI. The impact of different types of probes used in EMFI attacks is explored and a calibration process used for lab experiments is presented. I will also discuss our preliminary results and conclude EMFI is a viable strategy for an attacker attempting to break a cryptographic implementation.