Sergei Skorobogatov's Home Page

Hello!

My name is Sergei Skorobogatov (Сергей Скоробогатов), I was born and grew up in Moscow, Russia. I received a graduate degree (M.Sc.) in Automatics and Electronics (Engineering Diploma) from the Moscow Engineering Physics Institute (MEPhI, МИФИ) in March 1997. Then I worked (part time) as an Engineer in MEPhI and as a contractor for the Ophthalmic Centre "Prozrenie" in Moscow, where I designed several electronic devices for eye sight diagnostic and correction.
I won a Computer Laboratory Research Assistantship at Cambridge and since April 2000 I have been working on a Ph.D. project in the Security Group at the Computer Laboratory of the University of Cambridge in the UK. As a part of this research I participated in EU funded G3Card project aimed to design a new generation of smartcard chips. This project was finished in January 2003 and since that I had an independent research grant. I submitted my Ph.D. thesis in September 2004, defended my dissertation in November 2004 and graduated in February 2005. In September 2004 I was promoted to the Research Associate position for my postdoctoral research here and in July 2006 I was promoted to the Senior Research Associate position. My research grant was extended several times and it is currently until the end of 2010, therefore I am always looking for interesting and beneficial projects which could provide funding for my ongoing and future research.

I work in the Hardware Security Group on tamper-resistant processors. Here is the list of some of my current ongoing projects:

• Investigation of hardware security related problems in SRAM, Flash and EEPROM memory of semiconductor chips including microcontrollers, secure memory chips and FPGAs. Evaluation against: fault injection, data remanence, side-channel attacks, heating attacks, side-channel emission analysis attacks, data extraction attacks (to appear in 2010), and other recently discovered attacks
• Investigation of hardware security related problems in hardware encryption engines embedded into various semiconductor devices. Evaluation against: side-channel attacks, fault injection, side-channel emission and other recently discovered attacks
• Hardware security analysis of nonvolatile memory structures in microcontrollers, smartcards, CPLDs and FPGAs against all known attacks
• Using Optical Emission Analysis for Estimating Contribution to Power Analysis
• Optically Enhanced Position-Locked Power Analysis
• Data remanence in EPROM, EEPROM and Flash memories
• Thermal imaging analysis of semiconductors
• Back side imaging techniques
• Fault injection attacks
• Laser scanning microscopy
• Side-channel attacks

Here are some of my project ideas for undergraduate students. Old project ideas are placed here.

What's New

I gave a guest lecture "Tamper resistance and hardware security" in the Part II Security course for undergraduate students 2009-10 on 20 November 2009. Slides are revised and new material is included compared to the last year lecture.

I gave a talk at the Security Group seminar on 13 October 2009 (slides: Optical surveillance on silicon chips: your crypto keys are visible). I presented my research into a new class of side-channel attacks - optical side-channel attacks on secure semiconductor chips. By using an inexpensive CCD camera to monitor the emission from operating chip, information stored in SRAM, EEPROM and Flash was successfully recovered. In extreme cases, AES key stored inside a secure FPGA chip and used for secure code updates could be extracted thus seriously compromising the hardware security. Protection against these new side-channel attacks should become a new challenge to chip manufacturers.

Using Optical Emission Analysis for Estimating Contribution to Power Analysis. (slides). I presented new inexpensive semi-invasive side-channel attack method which is marking new direction in the hardware security arm race between developers and attackers. 6th Workshop on Fault Diagnosis and Tolerance in Cryptography (FDTC 2009).

Local Heating Attacks on Flash Memory Devices (slides). I presented a new semi-invasive attack technique which is aimed on modifying Flash and EEPROM memory as well as data extraction directly from the memory cell. Appeared at 2nd IEEE International Workshop on Hardware-Oriented Security and Trust (HOST-2009).

I gave a talk at the Security Group seminar on 20 January 2009 (slides: Hardware security: trends and pitfalls of the past decade). I was talking about progress in the hardware security area during the past decade. Instead of looking at various attack technologies, like I did in my previous lectures, I paid more attention to underlying problems of security failures caused by silicon hardware. I summarised achievements in attack and defence technologies and discussed some hardware security related issues of security economics and security psychology. After giving some examples of low-cost attacks on moderately secure silicon chips, I finally tried projecting the trend of hardware security area into the nearest future which is likely to be fruitful on news of more previously thought unbreakable devices actually being easy to attack.

I gave a guest lecture "Tamper resistance and hardware security" in the Part II Security course for undergraduate students 2008-09 on 24 November 2008.

I was contacted many times in the past with questions about consulting projects I can perform here in the lab. It was mainly caused by rapidly growing concerns about hardware security of semiconductor products (mostly microcontrollers, CPLDs and FPGAs) and growing intellectual property theft in Asian countries where most outsourcing is taking place. Some projects were aimed on finding security flaws in existing devices in order to improve their security or to select the most secure parts from a list. Other projects were dedicated for teaching and educating personnel. While other projects were about developing of certain attack techniques. More information on the types of research projects I carry out can be found here.

I prepared a short live hardware security demonstration course for students. Demonstrations involved decapsulated samples show, optical microscopy and rear-side infrared microscopy of various microcontrollers including deprocessed chips, optical fault injection history and live attack on security in microcontroller, power analysis attack on security in custom design. A short version of the demonstrations were also given as a part of Show and Tell local event here in the Computer Lab on 29 September 2008.

I gave a talk as invited speaker at the IPAM Workshop on Special purpose hardware for cryptography: Attacks and Applications, December 4 - 8, 2006, Los Angeles (Abstract and Slides).

I gave a talk at the Security Group seminar on 31 October 2006 (slides: Optically Enhanced Position-Locked Power Analysis).

Optically Enhanced Position-Locked Power Analysis (slides). New fascinating results of applying semi-invasive attacks to on-chip SRAM arrays for recovering information about its internal functionality without interfering with the chip operation. Appeared at Cryptographic Hardware and Embedded Systems Workshop (CHES-2006)

I gave a four-hour talk as invited lecturer at the ECRYPT Summer School on Cryptography in Louvain-la-Neuve (Belgium) 12-15 June 2006. I gave an introduction to hardware security and presented my achievements in hardware security analysis in the last six years. The abstract of the talk and references are available here. Slides for Part 1, Part 2, Part 3 and Part 4 of my talk are now available.

My Ph.D. thesis, which discusses the area of my research and achievements up until the end of 2003, has been out since April 2005 and exists in forms of hardbound copy and on-line Technical Report version. No part of my thesis or correspondent Technical Report may be used to produce any other reports or publications. It can be viewed on a computer or printed out for reference and consultation purposes only. You must contact me and obtain my permission in writing if you want to reproduce or use any images or diagrams from my thesis. I do not provide or authorise any translation of my thesis into other languages.

Recently updated material

• Poster on Optical surveillance on silicon chips
• Tamper resistance and hardware security. Guest lecture in the Part II Security course 2009-10.
• Optical surveillance on silicon chips: your crypto keys are visible. Talk at the Security Group seminar 13/10/2009 (slides).
• Using Optical Emission Analysis for Estimating Contribution to Power Analysis. 6th Workshop on Fault Diagnosis and Tolerance in Cryptography (FDTC 2009). IEEE-CS Press, ISBN 978-0-7695-3824-2, pp.111-119 (slides).
• Local Heating Attacks on Flash Memory Devices. 2nd IEEE International Workshop on Hardware-Oriented Security and Trust (HOST-2009). IEEE Xplore, ISBN 978-1-4244-4804-3 (slides).
• Hardware security: trends and pitfalls of the past decade. Talk at the Security Group seminar 20/01/2009 (slides).
• Tamper resistance and hardware security. Guest lecture in the Part II Security course 2008-09.
• Semi-Invasive Extension to Physical Attacks (Abstract and Slides) . Invited lecture for IPAM, UCLA. Securing Cyberspace: Applications and Foundations of Cryptography and Computer Security. Workshop IV: Special purpose hardware for cryptography: Attacks and Applications. Los Angeles, 4-8 December 2006.
• Poster on Optically enhanced position-locked power analysis
• Poster on Power analysis attacks
• Optically Enhanced Position-Locked Power Analysis. Talk at the Security Group seminar 31/10/2006 (slides).
• Optically Enhanced Position-Locked Power Analysis. Cryptographic Hardware and Embedded Systems Workshop (CHES-2006), LNCS 4249, Springer-Verlag, ISBN 3-540-46559-6, pp.61-75 (slides).
• Translation into Russian of Optical Fault Induction Attacks paper. Cryptographic Hardware and Embedded Systems Workshop (CHES-2002), LNCS 2523, Springer-Verlag, ISBN 3-540-00409-2, pp.2-12
• Poster on Data remanence in non-volatile semiconductor memory (Part II)
• Tamper resistance and physical attacks (Slides 1, Slides 2, Slides 3 and Slides 4). Four-hour invited lecture at the ECRYPT Summer School on Cryptography in Louvain-la-Neuve (Belgium) 12-15 June 2006.
• Cryptographic Processors -- A Survey (Invited Paper). IEEE Proceedings, Special Issue on Cryptography and Security, February 2006, Vol.94, No.2, pp.357-369. Full version is available as a Technical Report UCAM-CL-TR-641.

My research proposal for the ongoing 2009-2010 academic year (public open abstract part only. detailed proposal and other parts are confidential)

Phone:  +44 (0)1223 763563
        +44 (0)1223 763744
Fax:    +44 (0)1223 334678
Email:  Sergei.Skorobogatov (at) cl.cam.ac.uk
        sps32 (at) cl.cam.ac.uk
        sps32 (at) cam.ac.uk
        Sergei.Skorobogatov (at) hushmail.com