METAMORPH INC — Department of Defense SBIR Phase II: HR0011SB20224-15

Description

We will develop a comprehensive approach to find RF-based side channels in complex heterogenous circuits, devise methods using active excitation to pull challenging signals out where passive mechanisms are infeasible and determine internal modes of operation in the target platform.  The system will make use of multiple advanced RF simulation techniques to predict the optimum side channel attacks for the target, followed by automated physical exploration to validate and refine the exploit.  Automated feature extraction and AI-based discrimination processes will build a high precision detector on a per-algorithm, per-hardware module execution basis. Simulation will be accomplished using state of the art model-based systems engineering tools derived from prior DARPA programs (Adaptive Vehicle Make) to automate exploit search.  Commercial RF simulation tools will be used to find mechanisms for energy to enter and exit a target, use resonant cavities to amplify signals, and inherent nonlinearities to modulate a signal of interest into an advantageous RF representation. Automation will both create the input models for the RF simulators and interpret results to extract side channel candidates. Automated physical measurements, implemented in the SideLOCK system developed in task 2, will automatically position, stimulate, and receive precise RF waveforms.  Runtime capabilities will enable a physical, frequency, and modulation search to both validate the simulation results and tune the attack to counter model and simulation uncertainties.  SideLOCK will collect the necessary raw data to enable characterization of modes and hardware subsystems executing on the target. Tools will apply a set of preprocessing algorithms to create feature sets for compact representation, maximum discernibility, and reduction of workload on the discriminator phase.  Automation will help to match algorithm to signal for best performance. AI techniques will be used to discriminate between operating modes on the target.  Facilities will help to select the neural network architecture and hyperparameters that permit mode discrimination.  Workflow engines will automate the training, using SideLOCK acquired, feature-extracted data. A system-wide manager will integrate the core parts of the system to perform end-to-end side channel design.  A GUI will simplify operation and allow monitoring of system progress. A pair of architectures will be used for testing, both a simple dual core ARM processor on the BeagleBone Black, and an advanced, heterogeneous processor containing multiple ARM processors, GPU, and multiple DSP cores for the complex test case.