EM Side-Channel Analysis of Data Leakage Near Embedded Bluetooth Low Energy Modules

A two-phase measurement method is presented to evaluate Bluetooth low energy (BLE) modules’ vulnerability to electromagnetic side-channel analysis attacks. In both phases, signals are collected by probing the fields near the surface of a chip that operates as a generic attribute profile (GATT) server, while it receives and processes data via Bluetooth. In Phase I, first optimal measurement configurations—time intervals, probe positions, probe orientations—are identified by computing the analysis-of-variance (ANOVA) F-statistic on signals collected from a multitude of such configurations while a few carefully chosen data are repeatedly sent to the GATT server. Then, these configurations are used to construct a reference database by collecting additional signals as specific additional data are sent to the GATT server. In Phase II, the chip is monitored using the optimal measurement configurations and the collected signals are compared to those in the database to extract the data. This side-channel analysis attack is shown to recover the Hamming weights of arbitrary data sent to the GATT server with ~99% success rate.