1 Introduction

Physical attacks exploit weaknesses of an implementation to reveal the secret information. These attacks are possible since very often an adversary has physical access to the target device and can easily record its activity. Among the physical attacks, side channel attacks have been demonstrated to be extremely powerful, since they allow to e.g., extract the secret key from a cryptographic circuit with minimal efforts. In a nutshell, side-channel attacks collect information leaked from the target device while data is being processed, and exploit the dependence between this leakage and the processed data. Information can leak through several “channels”, including power consumption [15], the time needed to complete an operation [14], and the chip’s electromagnetic emissions [1].

Researchers dedicated significant efforts to defeat these attacks. However, developing general, reliable and effective countermeasures against physical attacks remains an extremely challenging task. Countermeasures are often considered only in the later stages of the full design flow, and applied manually by designers with strong security expertise. Very little is known about the interaction between different physical attacks and about the role which a countermeasure against one physical attack would play on the robustness of the device against another attack. The problem will be further complicated in the near future when cyber-physical systems will pervade several areas of our daily lives, including numerous safety-critical or privacy-relevant ones. These devices will have to provide strong security, but they should also often provide safety, real time computation capabilities, and achieve an extremely little energy footprint.

In view of this increasingly relevant problem, it is crucial to have the complete awareness of the security threats which cyber-physical system will have to face and to address the design challenges associated with the deployment of systems secure against physical attacks. This paper summarizes the main physical attacks and discusses three possible future research direction in the area.

2 Overview of Physical Attacks

In cryptography, a physical attack is an attack where the adversary, instead of focussing on the mathematical structure of a cryptographic routine, tries to extract secret information by exploiting the weaknesses of its implementation. Physical attacks are usually divided in two groups: active attacks and passive attacks. During an active attack, the adversary has to actively manipulate the device, by modifying its inputs or its operating environment, to force it to behave abnormally. This abnormal behavior is then exploited to perform the attack. During a passive attack, the adversary observes the normal behavior of a device and analyzes some side effects to gain information of the secret key.

Side channel attacks are very powerful passive attacks. Informally, a side channel is an information (often unintentionally leaked) which, indirectly, allows to infer knowledge about a different, and often more interesting, event. Side channels have been used and are used in several fields. For instance, the amount of pizza delivery over night in offices was used to infer if some important activity was under planning, the use of electric power was used to determine if a person was actually residing in the declared house. A field where side channels are deeply used is biology. Biological tests and medical exams often do not check directly the presence of a particular virus or of a specific disease, but they examine a side consequence which indicates with good approximation if the searched disease is present (for instance, positron emission tomography checks the concentration of light emitted by radioactive sugar, to infer, in a less invasive way, the possible presence of cancer).

Side channel have been also used in security for several years. A well known example of of the use of side channel for security application is the opening of safes. The mechanical locks of the safes which were used in past centuries were producing a slightly different noise when the pin of the combination was aligned to the correct digit. Exploiting this difference in noise, bank robbers were able to infer the secret combination and open the safe without trying all possible combinations of the lock. Nowadays, most of our security systems are controlled by electronic components. Instead of mechanical noise, attackers exploit other side information, such as power consumption or time needed for computation, but the principle is the same: use some side information to extract the secret data.

To take advantage of physical vulnerabilities however, the adversary needs to have physical access to the device. Such access was not always available. At the beginning of the digital era, when the computation was carried out in insulated mainframes, it was almost impossible to access the devices. As a result, physical attacks were not possible. Years later, with the diffusion of personal computers, it became easier to have physical access to the devices. However, personal computers are usually located in a rather safe environment (inside an office or an apartment), which is still reasonably protected from an adversary. As a result, the main security threats for personal computers were mainly coming from viruses and unprotected network connections.

The situation dramatically changed with the creation of the internet of things (IoT) and the pervasive diffusion of the embedded systems which are populating it. These devices are often operating in a hostile environment, and very often they are easily accessible by adversaries. In this scenario, where the devices are available to the adversary, resistance against physical attacks has become of primary importance.

Physical attacks as we know today appeared in the open literature in the late Nineties, but the recent declassification of the project Transient Electromagnetic Pulse Emanations Standard (TEMPEST) [12] demonstrates that there was awareness of the problem at least since fifty years before.

Timing analysis, the first physical attack that was published, was presented in 1996 by Kocher et al. [14]. Timing analysis attacks exploit the different time required by a device to process different data and to carry out different computations. Such time difference is due to several factors, such as the time needed to fetch the data (cache or memory hit or miss), the program behavior (branch taken or not), or the speed of difference components (a multiplier is generally slower than a shifter). Although these timing characteristics are often extremely small, the work of Kocher et al. demonstrates that they are sufficient to infer the entire secret key.

Soon after the first timing analysis attack was presented, Boneh et al. [7] proposed fault attacks. Fault attacks are attacks in which an adversary voluntarily induces a fault into a circuit and exploits the erroneous behavior to gain information about the secret key. The first step of a fault attack is the introduction of an error, possible transient, in the device. There are several ways to induce a fault. The adversary usually trades the cost of the equipment for mounting the fault with the precision of the injection (and thus the power of the attack). Common methods to inject faults are: variation in supply voltage, variation of the external clock, variation of operating temperature, exposure to X-rays, or precise laser illumination.

Power analysis was presented in 1999 [15]. The instantaneous power consumption of a cryptographic device strongly depends on the processed data and on the performed operation. Power analysis attacks essentially exploit this fact. These attacks are very powerful and can be performed with pretty inexpensive equipment. Several variations of power analysis attacks have been proposed in the past, the two most common are simple power analysis and differential power analysis. In simple power analysis attacks, an adversary attempts to derive the secret directly interpreting a set of power traces collected during the computation of the cryptographic routine. To be effective, simple power analysis requires often a detailed knowledge about the implementation of the cryptographic algorithm under attack. Differential power analysis attacks allows to retrieve the secret key with the only knowledge of the algorithm used in the device under attack. DPA attacks are based on a divide and conquer approach: the general idea is that the attacker, instead of attacking the whole key at once, targets a small portion of it, makes a hypothesis on possible values of the key and verifies these hypothesis using the power traces. The full key is recovered iterating this process.

Fig. 1.
figure 1

Number of references to the first paper presenting each of the most common physical attacks (data collected the 8th of August 2016). This plot gives the intuition of the amount of research activity per attack.

Full size image

After these pioneering works, several other physical attacks and channels have been discover and presented, including attacks exploiting the electromagnetic emission of a device [1] and attacks exploiting the photons emitted by electronic components during the computations [23]. The scientific community devoted significant efforts to the study of the problem. As usual, research activities focused on attacks and countermeasures against attacks. On the one hand, researchers tried to develop countermeasures to defeat physical attacks (or, at least, to complicate as much as possible the task of the attacker). Hardware implementations and software routines capable of computing cryptographic operations in constant time [13], hiding the power consumption using power analysis resistant logic styles [8, 26,27,28] or masking it using randomization [17, 19], or efficient error detection and correction codes [6] are possible examples of countermeasures developed over the years. On the other hand, researchers tried to improve the effectiveness of the attacks to better understand their potential and limits. Template attacks [9] and fault sensitivity [16] are two possible example of this improvement. Furthermore, especially for power analysis, researchers also developed metrics for fairly evaluate the robustness against attacks [25].

The amount of carried out research dealing with physical attacks is visible from Fig. 1, which depicts the number of references, as reported on Google scholar [24] the 8th of August 2016, to the first papers discussing each of the most common physical attacks. Although not being an exact and precise measure, this figure gives an intuition of the large impact which physical attacks had (and still continue to have). The physical attack more deeply studied is power analysis. This is probably caused by the power of the attack and by the relatively inexpensive equipment needed to mount it. Electromagnetic attacks and photon emission attacks did not get the same exposure as the other physical attacks simply because they appeared only recently. Surprisingly, fault attacks were not investigated with the same effort as timing and power analysis attacks. This fact is unexpected because, at least in their low cost version, fault attacks are extremely simple to be carried out.

Despite such a vast effort however, the problem of physical attack is still on scientific agenda, since some issues are still open. We need a better understanding of some physical attacks (as visible from Fig. 1, only power analysis and timing attacks have been explored in depth), we need to develop effective countermeasures against some other attacks, in particular photon emission, and several other problems have to be addressed to ensure the robustness of cyber-physical and embedded systems. The next section will focus on three of these problems, presenting their main challenges and highlighting possible research directions.

3 Challenge 1: Interaction Between Physical Attacks

Physical attacks, so far, have been mainly analyzed in isolation. This fact is even more evident when it comes to the design of countermeasures. Researchers often concentrate on one type of attack, developing a countermeasure against it and evaluating how the protected design behaves compared to the original one. However, the goal of the attacker is just to get access to the secret information stored in the device (and not get access to the secret key using a specific attack). Thus, application of a countermeasure against one attack without considering the global effect on security of the countermeasure is extremely dangerous. In fact, countermeasures against one attack might harm the robustness of the system against another type of attack.

An example of this risk reported in the past is the negative effect which countermeasures against fault attacks have on the resistance of a circuit against power analysis [21]. Several error-detecting and correcting codes have been used to harden the non-linear transformation of the AES algorithm and have been analyzed. Each error-detecting and correcting code is characterized by its coverage and its error recovery capability. As a result, some codes where more suitable than others to protect against fault attacks. After this exploration, the resistance against power analysis attacks of each of the considered error-detecting and correcting codes was analyzed in detail, using the information theory metric [25]. The results, reported in Fig. 2, demonstrate that the circuit characterized by the highest resistance against power analysis attacks is the one without any error-detecting and correcting codes (basically the one which could be easily attacked by fault attacks).

Fig. 2.
figure 2

Resistance against power analysis attacks analyzed using information theory (from [21]). Several error detection and correction circuits have been analyzed (Parity, Complemented Parity, Double Parity, Residue Modulo 3, Residue Modulo 7, Hamming Code, and a reference version without any additional circuit). The most resistant against power analysis attacks is the left most curve, the blue one, which is the reference circuit where no support for resistance against fault attacks was added. (Color figure online)

Full size image

This example shows that, even though the intention of the designer was to increase the resistance of the circuit by making it more robust against fault attacks, the achieved result was to help the attacker, since the added circuit significantly simplified the procedure for extracting the secret key using a different type of attack. Currently we have a pretty good knowledge of some physical attacks, but we still know very little about the possible interaction between them and we know even less about the about interactions between the different countermeasures which we apply. Exploring these problems in much more depth is of crucial importance for designing much more resistant and much more secure embedded and cyber-physical systems.

4 Challenge 2: Automatic Application of Countermeasures

Despite the pervasive diffusion of electronic systems also in extremely private and critical aspects of our live, security is often considered only at the end of the whole design process, after other goals (such as performance and cost) are achieved. This is not a good approach for designing secure systems in general, but is even less effective for tackling the problem of physical attacks, since these attacks are strictly depending on the underlining architecture and on the specific implementation. Thus, a much more effective way of achieving robustness from physical attacks is to consider security since the beginning of the whole design flow, and to use security related metrics as forefront design variables as now are area or memory occupation, performance, and power consumption.

Furthermore, implementations of countermeasures against physical attacks require engineers and designers with strong security expertise and good knowledge of state of the art in the field. Currently designers have to rely only on their experience and on good practices for finshing the implementation. Once the design is completed, it is evaluated by laboratories which test the device against a number of known attacks. If problems are encountered, the design has to be corrected and re-evaluated.

A parallel can be made between today’s techniques for achieving physical attacks resistance and the design process of electronic circuits as it was decades ago. At the beginning, design of electronic circuits was carried out by teams of expert designers, who were sometimes manually drawing the layout of the fabrication masks. Then electronic design automation arrived to support designers in their tasks. The boosted productivity (together with the progresses of technology) allowed us to achieve the level of integration and to handle the level of complexity which made possible the existence of extremely powerful personal computers, smart devices and all other electronic components which are currently populating our lives.

In the same way, security would significantly benefit from the development of design tools allowing designers to automatically apply countermeasures against physical attacks, to evaluate their effects, to early estimate the impact of these countermeasures on other design parameters and to verify their correct application. An automation tool would take an unprotected design and apply a set of existing countermeasures, as would have been done by a designer. Such automation tools would not replace the work of researchers studying and designing novel and more effective countermeasures (as electronic design automation did not replace designers manually implementing extremely optimized blocks), but would provide an essential support for implementing systems which are robust against physical attacks by constructions and, ultimate, overall more secure.

Despite the importance of these topics, design automation for security did not receive significant attention. Previous works have addressed the topic mainly from the hardware point of view, proposing design flows for power analysis resistant logic styles [20, 28, 29]. More recently, the topic of automatic application of physical attacks countermeasures tackled also software aspects, proposing tools for power analysis aware instruction set extensions [22], and compilers for the automatic application of software countermeasure as hiding and masking [3, 4, 18]. The focus was still mainly on power analysis attacks. Verification tools for asserting the correct applications of countermeasures have also subject of research [5, 10, 11]. Verification tools are extremely important since they would allow to immediately identify not only errors introduced by designers during the implementation, but also several other security pitfalls, such as intrinsic weaknesses of the applied countermeasure and the involuntary removal of protections caused by various optimizations carried out in the tool chain.

These works represent however only the begin of a research direction, the one of automation tools for security, still in infancy, which would, once more developed, enable the design of more physical resistant, and thus overall more secure, embedded and cyber-physical systems.

5 Challenge 3: Physically Secure Cyber-Physical Systems

Embedded systems are becoming more and more intelligent and connected. Together with network connectivity, these devices began to integrate sensors since several years. Now, these devices integrates also some support for autonomous decision and actuators for putting these decisions in place. Systems composed by an analysis and decision-making part (cyber) and by a sensing and actuating parts (physical) take the names of cybper-physical systems (CPSs). The block representation of such systems is depicted in Fig. 3.

Fig. 3.
figure 3

Simplified schema of a Cyber-Physical system. It composes a cyber part, which analyzes the data and take the decisions, and a physical part, which usually consist in two parts: one devoted to sensing and one devoted to actuating the decision taken by the cyber part. Currently, security researchers are mainly focusing on securing the cyber part of the CPS. Almost no attention is devoted yet to the security of the physical part of the system. (Color figure online)

Full size image

The presence of actuators dramatically increase the consequences of misuse of such systems, since a malicious attack can cause much more damage than the ones cause by a leak of private data. Cyber-physical systems are often used in critical applications, e.g., to automatically monitor patients or to control our smart grid. The security of these applications should be guaranteed, since a breach in such systems might have also catastrophic consequences and cause also the loss of human lives. For these reasons, it is of utmost importance that the cyber part of CPSs is resistant against physical attacks.

However, this is not sufficient. Cyber-physical systems are composed of two parts, a cyber part, very similar to the computational part of embedded systems, and a physical part. We know what are the threats to the cyber-part, and we know what can be the defense mechanisms for it. However, the goal of the attacker is to take control of the system, not necessarily take control of the system attacking the cyber part. An attack directed to the physical part, could be much simpler while allowing the adversary to reach his goal. In the past, security was only concentrating on cyber attacks carried out against electronic components.

As discussed in Sect. 2, the discovery of physical attacks against the electronic components was devastating for embedded systems. Now, with the addition of a physical part to systems, the game changes again. The physical portion of CPSs will be exposed, exactly as the cyber part, to cyber and physical attacks. However, we are not prepared to address this new situation, since little or nothing is known about attacks and countermeasures against the physical portion of a system. Few works addressed the problems so far (physical attacks to the physical portion of CPSs were analyzed, for instance, in the context of additive manufacturing [2]). Future security research should definitely address, as indicated by the red arrow in Fig. 3, security threats and possible countermeasure devoted to the physical portion of systems, since the adversary will attack through the weakest point, and the physical part is much likely to be the weakest point of CPSs.

6 Conclusions

Approximately 20 years have passed since physical attacks were published in the open literature. Since then, researchers have deeply studied the subject, aiming on the one side at discovery of new and much more powerful ways for carrying out the attacks, and on the other attempting to increase the robustness of the implementations. Nevertheless, several problems are still open. This paper presented three (of the many) possible directions for future research in the area, namely the study of the interaction of different physical attacks (and the effects which a countermeasure against one attack might have on the robustness against another physical attack), the study of techniques for automatically applying countermeasures against physical attacks (and to verify the proper applications of them), and, finally, the study of the robustness of cyber-physical systems, where the presence of a physical part could completely change the rules of the game.