Current Probe. Inspector Data Sheet. Low-noise, high quality measurement signal for side channel acquisition on embedded devices.

Size: px

Start display at page:

Download "Current Probe. Inspector Data Sheet. Low-noise, high quality measurement signal for side channel acquisition on embedded devices."

Rosemary Marshall
5 years ago
Views:

1 Inspector Data Sheet Low-noise, high quality measurement signal for side channel acquisition on embedded devices. Riscure Version 1c.1 1/5

Introduction Measuring the power consumption of embedded technology to perform side channel analysis adds specific challenges to the measurement setup.

2 Introduction Measuring the power consumption of embedded technology to perform side channel analysis adds specific challenges to the measurement setup. Power lines on embedded devices are generally noisier, signals travel at a higher speed and there is a lot of variety in form factors compared to smart cards. To perform side channel analysis on embedded devices, such as System-on-Chip devices and FPGA s, our Inspector software and Current Probe provide a solution for tackling these challenges. Key features Wide bandwidth to measure signals from 1 MHz to 1 GHz Low impedance to minimise the influence on the TOE power circuit Electrical isolation for ease of use High sensitivity to measure weak TOE supply current fluctuation Low noise for a high quality measurement signal Functionality Chips in embedded technology come in various shapes. To conduct power analysis (DPA), a flexible kit is required that can be applied to any cryptographic processor. By connecting the to the power line on a PCB, a clean and amplified signal of the power consumption is produced to the oscilloscope that feeds into the Inspector software. Any trigger signal is not influenced by the current probe. The trigger signal for multiple measurements is programmed by the user on the TOE or derived from the power signal by Riscure s real-time trigger generator called icwaves. Technical description The has two inputs connected by a filter. For low frequencies (f < 200 khz), the filter acts as a short circuit (R = 60 mω). The DC voltage drop UDC over the current probe can be calculated by multiplying the DC supply current IDC of the TOE with the probe resistance R: U DC = I DC * R. For high frequencies (f > 200 khz), the supply current fluctuations are measured and amplified to the output signal Riscure Version 1c.1 2/5

3 How to use the? 1. The power supply chain of the embedded TOE must be opened. The location to open the supply chain should be chosen such that the capacitance C2 (Figure 2) between the cut and the TOE is minimal just sufficient for proper operation of the TOE. One of the probe inputs must be connected to the Vcc pin of the TOE and the other input to the power supply of the TOE or the stabilizing capacitor C1. 2. The probe output is connected to the amplifier which is powered by a 12V adapter. The output of the amplifier should be connected to the input of the oscilloscope. A trigger signal for the oscilloscope should be programmed on the TOE, derived from the current signal using the icwaves or provided from the PC. If the output of the amplifier clips, you could connect 10dB attenuator between and Amplifier 3. Shielding offers you flexibility of connecting to target or leaving it open. 4. Acquire power traces in Inspector by controlling the TOE and oscilloscope from within Inspector via the supported interfaces and protocols. Inspector provides an IDE and API to make your own modules, allowing you to flexibly adapt to your testing environment and the TOE. C1 +Vcc open Attenuator Amplifier signal out BNC 50 Ω C2 12 v TOE Embedded Chip Shielding Power adapter V 50-60Hz Figure 2 Circuit diagram of current probe and connections Riscure Version 1c.1 3/5

4 Vin Vcc+ Vcc- from white noise generator 50 Ohm Shielding-Open input impedance of oscilloscope channel 50 input impedance of oscilloscope channel Figure 3 Figure 4 Figure 5 Riscure Version 1c.1 4/5

5 Performing DPA on embedded technology with Inspector Due to its flexibility and non-invasive nature, the EM Probe Station is often the first choice for side channel analysis on embed ded technology. However, if the crypto processor is covered with cooling elements, shields and other processors, the is more effective. Technical specifications Frequency response (see Figure 4) DC probe impedance 60 mω + 10 μh < 200kHz Probe sensitivity is 25 mv/ma without amplifier (into 50 Ω impedance) Max DC input Current: 4A Signal output with 50 Ω impedance Built-in Tektronix CT1 current probe Frequency response and testing circuit (see Figure 3 and 4) Attenuator features Impedance: 50Ohm Attenuation: 10dB Amplifier features Frequency Range: MHz Gain :25dB (measured at 1000MHz) Noise Figure 2.4dB(measured at 1000MHz) Clipping output voltage: +/- 160mV (measured at 100MHz) DC Power: 12V SMA Connector-50Ohm Typical 25 C (see Figure 5) Riscure BV Frontier Building Delftechpark XJ Delft The Netherlands Phone: +31 (0) Fax: +31 (0) inforequest@riscure.com CP Frequency characteristic of built-in Tektronix CT1 current probe Riscure provides these specifications for information only. No rights can be obtained from these specifications. Riscure Version 1c.1 5/5

Current Probe. Quick Start Guide. What is in the box What does it do How to build a setup Help and troubleshooting...

Current Probe. Quick Start Guide. What is in the box What does it do How to build a setup Help and troubleshooting... Current Probe Quick Start Guide What is in the box... 2 What does it do... 4 How to build a setup... 5 Help and troubleshooting... 8 Technical specifications... 9 2015 Current Probe 1 - QSG 1.0 1 / 12