🤖 AI Summary
This study addresses a critical limitation of traditional electromagnetic shielding, which effectively suppresses passive radiation leakage but fails to protect against active radio-frequency (RF) probing attacks. For the first time, this work systematically demonstrates that even within shielded environments, impedance modulation caused by device state transitions can leak sensitive information via backscatter. To validate this vulnerability, the authors construct prototype platforms using FPGAs and microcontrollers, integrating three industrial-grade shielding configurations. Through controlled RF injection and analysis of reflected signals, experiments reveal that passive measurement techniques lose discriminative capability post-shielding, whereas active backscatter remains highly effective in distinguishing different computational workloads. These findings expose a previously overlooked security risk wherein existing shielding mechanisms can be subverted by active probing, thereby challenging the conventional security evaluation paradigm that focuses exclusively on passive emissions.
📝 Abstract
Electromagnetic (EM) shielding is widely used to suppress radiated emissions and limit passive EM side-channel leakage. However, shielding does not address active probing, where an adversary injects external radio-frequency (RF) signals and observes the device's reflective response. This work studies whether such impedance-modulated backscattering persists when radiated emissions are suppressed by shielding. By injecting controlled RF signals and analyzing the reflections, we demonstrate that state-dependent impedance variations remain observable at frequencies outside the shields'primary attenuation band. Using processors implemented on FPGA and microcontroller prototypes, and evaluating workload profiles under three industry-standard shields, we find that passive EM measurements lose discriminative power under shielding, while backscattering responses remain separable. These results indicate that active RF probing can expose execution-dependent behavior even in shielded systems, motivating the need to consider active impedance-based probing within hardware security evaluation flows.