Analog Pin Directionality as an Exfiltration Attack Surface in Mixed-Signal ICs
Researchers demonstrate exfiltration through nominally input-only analog pins in mixed-signal ICs, recovering data at 10 kbps on a 55nm PPG front-end.
The paper identifies a directionality-based attack class in analog/mixed-signal (AMS) ICs where data-dependent circuit-offset modulation converts a nominally input-only pin into an outbound information channel. Three host conditions enable the attack: a closed-loop amplifier, an exposed amplifier input, and sufficiently high impedance at that pin. Silicon validation on a photoplethysmography analog front-end in 55nm CMOS showed exfiltration at up to 10 kbps with error-free PRBS recovery, under 0.001% area overhead, and only 0.03 dB SNR reduction.
- Data-dependent circuit-offset modulation turns input-only analog pins into outbound covert channels.
- Attack requires a closed-loop amplifier, exposed amplifier input, and high pin impedance.
- Silicon-proven on a 55nm PPG AFE: 10 kbps exfiltration and error-free PRBS recovery.
- Payload costs under 0.001% area and reduces filtered PPG SNR by only 0.03 dB.
- Authors urge treating analog pin directionality as an explicit AMS security property.
- Products
- photoplethysmography AFE
From the original article
1 min read at arxiv.orgMixed-signal SoCs rely on nominally input-only analog pins to acquire off-chip signals, but the directionality of these interfaces is generally treated as a functional property rather than explicitly verified as a security property.
By Ramana Ranganatham · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.