5

Are there any papers that can document that using an online UPS (Uninterruptible Power Supply) can reliably protect against power-analysis attacks that attempt to read keystrokes on wired keyboards?

The following Blackhat paper describes such an attack:

http://www.blackhat.com/presentations/bh-usa-09/BARISANI/BHUSA09-Barisani-Keystrokes-PAPER.pdf

However, no protection is mentioned, beyond using "TEMPEST hardware".

Again I'm looking for a (preferably) scientific source to document such an effect. It seems like there may be issues with naively relying on an UPS. For one, there are several different types of UPSes (offline, line-interactive, online, and probably variants and implementation specific details), and there may be shared grounds from other sources, such as wired Ethernet connectivity.

If no such paper exists or can be found, at least a thorough explanation would be nice.

  • Wouldn't a simple power line filter which filters out PS/2 clock frequencies be enough? – George Y. Feb 13 '18 at 22:56
  • @GeorgeY. Notch and low-pass filtering of power lines is not as trivial as it sounds, particularly on high-power loads. RC filters insert a series resistor into the current path, which ends up limiting the current and making it impossible to run large loads (e.g. a PC). If you drop the resistance down you need to increase the capacitance in order to maintain the same filter frequency, and then you still run into the problem that the power dissipated over the resistor is P=I^2R, so for a 600W load on 110V that's 30W dissipated over a single resistor - that'll need active cooling. – Polynomial Feb 14 '18 at 0:24
  • @GeorgeY. The usual solution is an LC filter built from a toroidal inductor and a capacitor, but toroidal inductors need to be very big if you're trying to build an LC filter for sub-KHz frequencies, and even bigger if they're handling serious power, and that makes them very expensive - you can easily spend £100 or more just on that single part if you try to design one yourself. The significantly cheaper option is a common mode choke, but these only impede high frequency currents - any noise of significant amplitude below a few tens of kilohertz will still leak out. – Polynomial Feb 14 '18 at 0:28
  • @Polynomial. Are these common mode chokes available for purchase, or design? What would one search for? – AlphaCentauri Feb 14 '18 at 2:01
  • @AlphaCentauri Search "common mode choke" on any electronic component wholesaler. But keep in mind that mains input chokes are already included in every switch mode power supply already (without them the mains wire would be a fantastic antenna for EMI and the device would likely fail EMC testing). – Polynomial Feb 14 '18 at 12:44
4

It very much depends on the UPS. Most UPSes, particularly under-desk form factor ones for home and small office use do not include power conditioning or filtering.

A simplified topology of a common UPS design looks a bit like this:

UPS topology

The AC usually flows directly from the AC IN to AC OUT, and the controller leaves the right hand side of the transformer unloaded. When the power fails, the controller senses that the input power is no longer present and starts producing an AC power source from the battery, which is stepped up by the transformer to take over the supply. The diagram above is heavily simplified but it gets the point across - when the regular AC power is present it's just like running the device straight from the wall socket.

There is another type of UPS design which includes a feature called power conditioning. These UPSes are usually very expensive and tend to be found in rack mount form factors rather than desktop units. Power conditioning UPSes usually include additional filtering in the form of an LC circuit (large toroidal inductor plus a large capacitor array) which acts like a low-pass on the power signal to remove noise and improve power factor. Depending on the characteristics of the filter, this may prevent power analysis side-channel attacks such as the one you described.

Yet another type of UPS is a DC UPS. These are usually used in specialist datacenter applications where it is more power-efficient (and sometimes heat-efficient) to have one large integrated UPS and switching DC power supply solution that provides a DC rail (usually 48V) to all systems in the datacenter, rather than each server switching down from mains AC to the required board-level voltages. Such a design would likely filter out power noise from the servers, thus preventing a side-channel attack, although in most situations you would expect the main UPS to be fed by 3-phase at higher-than-domestic voltage, thus making any direct interface with that power rail extremely dangerous, which is a pretty good deterrent.

  • A cheap way to get power conditioning would be to use an online double-conversion UPS. It is constantly charging and discharging simultaneously so power loss will never result in the short delay required to detect the loss and switch. They're a lot less efficient (think 80%), but they can at least in theory provide the same properties as true power conditioning. Also note that, without red/black separation, chances are even a high-end power conditioning UPS will not provide any EMSEC protection. You need an actual NATO SDIP-27 certification for the hardware to trust it. – forest Feb 14 '18 at 2:47
  • @forest Indeed. They fall under power conditioning UPSes, since the load is essentially isolated. – Polynomial Feb 14 '18 at 12:42
  • Many UPSs have power consumption metering built in. Do these have the sensitivity and responsiveness needed to sense the keyboard? If so, could hijacking a UPS be a way to remotely perform the attack? – John Deters Feb 16 '18 at 14:41
  • @JohnDeters I very much doubt it. The fastest power sense ICs I know of have an inter-measurement period of a few hundred microseconds, which would alias the samples pretty heavily and prevent you from being able to filter out background noise. You really need specialist hardware to do power analysis, e.g. a ChipWhisperer. – Polynomial Feb 16 '18 at 15:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.