A Probe Placement Method for Efficient Electromagnetic Attacks

Electromagnetic (EM) emissions have been explored as an effective means for non-invasive side-channel attacks. The leaked EM field from the memory bus when the data is loaded from the on-chip memory has received considerable attention in literature. Meanwhile, off-chip memory buses gradually become the new attack target due to the relative ease of access in the modern system in package technologies, such as 2.5-D integration where processing and memory chips are integrated, for example, on a silicon interposer. This paper, therefore, investigates EM snooping attacks on interposer-based off-chip memory buses. A gradient-search algorithm is proposed to locate fast (i.e. O(N)) the most efficient attack point. The effectiveness of the search algorithm and attack efficiency is evaluated on a 64-bit bus. It is demonstrated that at the optimal attack point, EM attacks can succeed with more than 10x fewer traces, compared to placing the probe to sub-optimal locations.