A real-time interception system for compromised frequency-hopping signal eavesdropping

Abstract

In modern computing architectures, sensitive data (red data) is carried out in the same processing units as encrypted data (black data). Due to leaks (internal mixing, coupling …), this red data can be emitted in a legitimate radio transmission through a so-called telecom side-channel. This new type of side-channel creates an important threat as it can be passively and remotely processed by a dedicated interception system. This threat becomes even more concerning within the context of the Internet of Things, as the use of low-cost components leads to increased leaks. This paper addresses telecom side-channels on frequency-hopping signals, that are harsh to eavesdrop due to their sporadic nature in both time and frequency domains. To that goal, a wideband interception system is proposed, able to intercept frequency-hopping signals in real time and to extract sensitive red data from it. The system relies on software-defined radios and leverages both hardware and software resources to process a 200MHz bandwidth in real time. The proposed architecture is capable of detecting jumps on the order of $20\mu s$ and can therefore track 50,000 jumps per second across 1,024 channels. Finally, the criticality of telecom side-channels in Bluetooth communications is demonstrated through real interception on several microcontroller chips.