\documentclass[11pt]{article} \usepackage{a4wide,parskip,times} \usepackage{tabularx} \usepackage{booktabs} \usepackage{array} \usepackage{graphicx} \usepackage{xltabular} \usepackage[hidelinks]{hyperref} \usepackage{pgfgantt} \newcolumntype{T}{>{\ttfamily}p{2.2cm}} \begin{document} \centerline{\Large Analysing DisplayPort Eavesdropping Risks} \vspace{2em} \centerline{\Large \emph{Project proposal}} \vspace{2em} \centerline{\large Applicant: Stefany Nizamova} \vspace{1em} \centerline{\large PI : Dr Markus Kuhn} \vspace{1em} \begin{abstract} % \textsl{Write an ``elevator pitch''. In other words what's the % problem, why is it important or interesting, and what's your approach. (100 words)} % \textsl{Electromagnetic emissions from electronic devices can leak information about the data being processed. % These emissions can be picked up by radio receivers in the vicinity and the data can be reconstructed. % For example, it has been shown that it is possible to reconstruct images displayed on a monitor by capturing the electromagnetic emissions from its video cable. % } % Electromagnetic emissions from digital circuits can unintentionally leak information \cite{Eck1985ElectromagneticRF}. Video interfaces, including VGA, DVI, HDMI, and LVDS, are known to be vulnerable to Tempest-style eavesdropping attacks that recover displayed images via amplitude demodulation of radiated signals. DisplayPort, a newer interface, was considered more resistant due to its scrambled and non-linear 8b/10b encoding, but recent work \cite{erdeljan_2023} demonstrated the first practical attack. % This project extends that work by addressing open challenges: leap-byte variability, multi-lane reconstruction, and processing efficiency; improving recovered image quality and attack practicality to advance our understanding of side-channel threats in modern display interfaces. % Electromagnetic emissions from digital circuits can unintentionally leak information. % Video interfaces, including VGA, DVI, HDMI, and LVDS, are known to be vulnerable to Tempest style eavesdropping attacks that recover displayed images by amplitude demodulation of radiated signals. % DisplayPort, a newer interface, was considered more resistant owing to its scrambled, non-linear 8b/10b encoding, but recent work has demonstrated the first practical attack. % Modern video interfaces are vulnerable to ``Tempest-style'' electromagnetic eavesdropping attacks, allowing adversaries to reconstruct displayed images from unintentionally radiated signals. % While the scrambled, non-linear encoding of the DisplayPort standard was historically thought to provide immunity, recent breakthroughs -- including the applicant's prior work -- demonstrate the first practical attacks. % This was achieved by detecting scrambler reset times to synthesize a local copy of the scrambler, and resolving byte-level synchronization challenges (known as ``leap bytes'') to achieve full RGB color reconstruction. % This project extends that work by addressing open challenges -- multi-lane reconstruction, processing efficiency, and a wider survey of target devices -- with the goal of progressing the attack from a proof-of-concept to a credible real-world threat. Electromagnetic emissions from digital circuits can unintentionally leak information; video interfaces including VGA, DVI, HDMI, and LVDS are known to be vulnerable to Tempest-style eavesdropping attacks that recover displayed images using radiated signals. DisplayPort, a newer interface, was considered more resistant due to its scrambled and non-linear 8b/10b encoding; however, recent work demonstrated the first practical attack by detecting scrambler reset times to synthesise a local copy of the scrambler -- enabling a template-based attack. The applicant's prior work extended this by resolving byte-level synchronisation challenges -- known as ``leap bytes'' -- to achieve full RGB colour reconstruction. This project extends that work by addressing open challenges: multi-lane reconstruction and processing efficiency. The programme is organised in two sequential stages: Phase~1 delivers the multi-lane DisplayPort feasibility study quoted here, and Phase~2 --- to be approved subject to the successful completion of D1 --- extends the validated methods to embedded DisplayPort (eDP) as used in laptop internal displays. \end{abstract} % scope of work % technical objectives % expected deliverables % timeline % estimated budget \section{Introduction, approach and outcomes} % \textsl{Provide an introduction to your project or essay. In particular, try to % motivate the work and explain the relevant context (general % background, as well as sufficient detail about any related % work).} % \textsl{The switching activity of digital circuits creates electromagnetic emissions that can leak information about the data being processed to radio receivers in the vicinity \cite{Eck1985ElectromagneticRF}. % For example, it has been shown that it is possible to reconstruct images displayed on a monitor by capturing the emissions from its video cable. % Video interfaces such as VGA, DVI, HDMI and LVDS have been shown to be vulnerable to such eavesdropping attacks, that work by amplitude demodulating the signal in a quiet band of the spectrum. % The resulting images can often be precise enough to recover readable text.} \subsection*{Background} Tempest attacks are a well-known confidentiality risk and have been demonstrated on various video interfaces. DisplayPort \cite{VESA_DisplayPort_v1.2} is a newer standard that is significantly more difficult to attack due to its complex encoding format involving a scrambler followed by a non-linear 8b/10b encoding step, resulting in random looking bit sequences. Recent work \cite{erdeljan_2023,journalpaper} has demonstrated the feasibility of DisplayPort eavesdropping: by searching for predictable scrambled sequences, the attacker can synthesise a local synchronised scrambler. This can be used to construct template signals that may be correlated against the received signal to recover the transmitted data. % Since the source's pixel clock and the link's clock are independent and are generally incommensurate, the number of link bytes per line is not fixed; instead it takes one of two values, chosen so that the average matches the required non-integer line length. Since the link's clock is chosen from a small number of fixed values whereas the pixel clock is dependent on the video mode, the average number of link bytes per line is not an integer, and therefore the length of a line varies by one byte. The pattern of these extra ``leap bytes'' is not well specified by the DisplayPort standard, creating challenges for the reconstruction process. Namely, the eavesdropper must know the position of leap bytes in order to maintain byte-level synchronisation with the source and achieve full RGB colour reconstruction. % Since DisplayPort specifies that lines satisfy a certain average length; where this is non-integer the length varies by one byte. This applicant's work \cite{dissertation} found that the pattern of leap bytes follows the same fractional-accumulator pattern produced by Bresenham's line drawing algorithm \cite{koopman1987bresenham}, and developed methods to automatically recover the accumulator's parameters -- its rate and phase -- from the received signal. Predicting leap bytes from these recovered parameters enabled the first full-colour reconstruction of DisplayPort screen content. \section*{Open problems} Several open issues remain. \textbf{Multi-lane} --- DisplayPort uses 1, 2, or 4 lanes depending on the video mode, and existing demonstrations target only the simplest single-lane modes. Since many common video modes are multi-lane, this extension is a key step towards characterising the practical threat of DisplayPort eavesdropping. From a signals perspective, the emissions of a multi-lane video mode are the superposition of the emissions from each individual lane; separating these may be possible by exploiting the fact that all lanes share the same scrambling sequence, offset by a fixed two-byte delay between adjacent lanes. % DisplayPort uses 1, 2 or 4 lanes depending on the video mode. Existing demonstrations target the simplest single-lane video modes. From a signals perspective, the emissions of a multi-lane video mode represent the superposition of emissions from each lane. % Extending to multi-lane video modes is a key step towards characterising the threat of DisplayPort eavesdropping in practice, since many common video modes use multiple lanes. % Multi-lane reconstruction should be possible by exploiting the fact that the same scrambling sequence is used across all lanes, with a 2-byte delay between adjacent lanes. \textbf{Alternative pixel formats} --- Some monitors automatically select alternative colour depths (e.g. 10-bit rather than 8-bit) which requires adaptations to the constructed templates. Attacks on such colour depths have been demonstrated, however more work is needed to understand the effect of colour depth on the attack and to potentially detect the colour depth from the signal dynamically. \textbf{Leap byte pattern detection} --- The leap byte pattern detection algorithm needs to be tested on a wider range of target images, video modes, device configurations and distances to characterise the attack's feasibility in practice. Different algorithms for leap byte parameter recovery should be tested, such as user-interactive search or integration with the existing scrambler-reset model. It is also possible that the \textit{rate} paramter of the leap-pattern can be inferred directly from the video mode, but more testing is needed to understand whether this parameter is common across different GPU, monitor and driver combinations, or whether it is device-specific. \textbf{Processing efficiency} --- Additionally, there is scope for efficiency optimisations in the reconstruction process, particularly through GPU-parallelisation of key processing steps, which would enable a more realtime implementation. This may be a prerequisite for tackling problems that increase computational complexity, such as multi-lane reconstruction, and would also support interactive exploration of the leap-byte parameter search. \textbf{Embedded DisplayPort (eDP)} --- Finally, DisplayPort is also commonly used across USB-C (DisplayPort Alt Mode) or for internal displays such as laptop screens, where the interface is known as embedded DisplayPort (eDP). Both cases remain open problems due to limited access to their specifications. eDP's principal content-protection method, Alternate Scrambler Seed Reset (ASSR), has very limited publicly accessible documentation \cite{linux_drm_dp_h, nxp_ptn3460}; however its name suggests the scrambler LFSR may be reseeded with an alternate value. In this case the attack might extend to eDP with only minor modification, provided the alternate seed can be determined, e.g.\ by brute-force search over the 16-bit LFSR state space. % \subsection*{Scope of work} % Several open issues remain for the attack to be a realistic threat. DisplayPort uses 1, 2 or 4 lanes depending on the video mode, but the existing demonstration only targets video modes that use one lane. Multi-lane reconstruction should be possible by exploiting the fact that the same scrambling sequence is used across all lanes, with a 2-byte delay between adjacent lanes. % Additionally, there is significant scope for efficiency optimisations that would enable a realtime implementation, such as parallel processing steps that could be well-exploited by a GPU. % The work would also benefit from a wider survey of target devices, to determine under what conditions the attack is feasible, and which features or implementations create challenges. % For example, prior work has found that attacking monitors with a 10-bit colour depth is possible, but requires adaptations to the attack. \subsection*{Programme structure} The work is organised as two sequential phases with a decision gate between them. \textbf{Phase 1 (D1)} is the multi-lane DisplayPort feasibility study, covering multi-lane reconstruction, processing efficiency and leap-byte detection. Its scope, objectives, deliverables and schedule are set out below. \textbf{Phase 2 (D2)} transfers the methods validated in D1 to embedded DisplayPort (eDP) as used in selected internal laptop displays. \textbf{Stage gate.} Progression to D2 is recommended if D1 demonstrates: (i)~working multi-lane reconstruction, or a clear characterisation of the conditions under which it succeeds; (ii)~a reconstruction pipeline efficient enough to make eDP experiments tractable; and (iii)~no fundamental obstacle identified in the D1 eDP feasibility survey (below). The gate review uses D1's written report as its evidence base. \subsection*{Phase 1 (D1): scope of work} This project will investigate the feasibility of electromagnetic eavesdropping against DisplayPort on consumer GPU and monitor hardware. Work will focus on extending the existing attack to support multi-lane video modes and improving processing efficiency. \subsection*{Phase 1 (D1): technical objectives} % \textbf{Multi-lane reconstruction.} DisplayPort uses 1, 2 or 4 lanes depending on the video mode, but the existing demonstration only targets video modes that use a single lane. Multi-lane reconstruction should be possible by exploiting the fact that the same scrambling sequence is used across all lanes, with a 2-byte delay between adjacent lanes. % \textbf{Processing efficiency.} There is significant scope for efficiency optimisations that would enable a real-time implementation, such as parallelising processing steps in a way that could be well-exploited by a GPU. \textbf{Multi-lane reconstruction.} Attempt to extend the existing single-lane reconstruction pipeline to support multi-lane video modes, exploiting the fact that the same scrambling sequence is used across all lanes, with a fixed byte delay between adjacent lanes. \textbf{Processing efficiency.} Develop a GPU-parallelised implementation of the reconstruction pipeline to approach a near-real-time reconstruction and support interactive parameter search. \textbf{Leap byte detection.} Leap byte parameters (rate and phase) currently must be recovered per-recording. This work will test alternative recovery algorithms, such as user-interactive search. \textbf{(Extension) Survey.} Time permitting, a wider survey of targets would help determine under what conditions the attack is feasible, and which features or implementations create challenges. This includes testing the full colour attack at distance and against realistic target images, testing against 10-bit colour depth, and investigating whether the leap rate can be inferred from the video mode, rather than recovered empirically, and whether any such relationship is device-specific. \textbf{(Extension) eDP feasibility survey.} Time permitting, D1 will undertake an eDP feasibility probe --- for example, investigating the emission characteristics of eDP links and whether the alternate scrambler seed can be recovered by brute-force search over the 16-bit LFSR state space. This will help guide the D1/D2 stage-gate decision and de-risks the Phase~2 scope. This is scoped as survey only; systematic eDP work is deferred to Phase~2 (D2). \subsection*{Phase 1 (D1): expected deliverables} \begin{itemize} \item A synchronisation and reconstruction pipeline extended to support decoding of multi-lane DisplayPort video modes. \item A GPU-accelerated implementation of the reconstruction pipeline. \item A written report summarising findings and their implications for DisplayPort's real-world exposure to Tempest-style attacks. \end{itemize} \subsection*{Phase 2 (D2): embedded DisplayPort (eDP) --- indicative scope} Phase~2 transfers the methods validated on external DisplayPort in D1 to eDP as used in selected internal laptop displays. \textbf{EM characterisation.} Acquire a small set of representative targets and establish a recording setup for internal eDP links (which, unlike external DisplayPort, expose no accessible cable and radiate from the panel and its flat-flex connection). Characterise the emission spectra and identify usable bands. Compare the eDP emission profile against the external DisplayPort baseline. \textbf{Reconstruction feasibility.} Adapt the Phase~1 reconstruction pipeline to eDP. Investigate ASSR to determine whether the scrambler is reseeded with an alternate value and, if so, attempt to recover that seed --- for example by brute-force search over the 16-bit LFSR state space, informed by the scrambler-reset model. Attempt template-based reconstruction of screen content and assess the achievable image quality. \textbf{Technical limitations.} Systematically characterise the limits of the eDP attack: which panels and configurations are susceptible, at what distances, and which features defeat or degrade it. Produce a threat characterisation for eDP and contrast it with the external DisplayPort threat surface. \textbf{Knowledge transfer.} Transfer the validated methods and tooling to the funder's team: documented and reproducible code handover, a setup and operating guide and representative recorded datasets. \subsection*{Phase 2 (D2): expected deliverables} \begin{itemize} % \item An EM characterisation report for the selected eDP targets, including recovered link parameters and usable emission bands. \item A reconstruction feasibility assessment for eDP, with reconstruction results or a documented negative result, including findings on ASSR seed recovery. \item A technical-limitations and threat-characterisation report for eDP. \item Knowledge transfer package: reproducible codebase, setup and operating documentation, recorded datasets and corresponding results. \end{itemize} % \subsection*{Phase 2 (D2): duration} % The indicative duration for Phase~2 is \textbf{7 months}, beginning after stage-gate approval (for illustration, March--September 2027, assuming D1 concludes as scheduled in February 2027). The indicative schedule is shown in the Timeline section below. % \textsl{What's the basic idea and approach? What are you thinking of % doing, and how is it going to solve the problem (or need) you've % identified. What are you going to ``produce''? % A project will typically produce one (or perhaps more) of the following: % a piece of software, an evaluation of a published result, a proof, or % the design (and perhaps the construction of) a new piece of hardware. An % essay will typically either review and critique a particular area of the % academic literature, or evaluate a published result or proof. Try to % name the specific things (and describe them) in this part of the % proposal -- this will allow you to refer to them in the next.} \section{Timeline} The schedule below covers Phase~1 (D1), followed by the indicative schedule for the contingent Phase~2 (D2). \newpage \noindent\textbf{Phase~1 (D1): schedule} % \textsl{Project students have approximately 26 weeks between the approval of % the proposal by the Head of Department, and the submission of the dissertation. This section % should account for what you intend to do during that time. You should divide the time into two-week chunks including dates, and % describe the work to be done (and, as relevant, milestones to be % achieved) in each chunk. You should leave two % chunks for writing a project dissertation. You should leave 1 chunk for contingencies.} % \renewcommand{\arraystretch}{1.4} % \begin{xltabular}{\textwidth}{l X X} % \caption{Time line (Aug 2026 -- Jan 2027)}\\ % \toprule % \textbf{Time Period} & \textbf{Task} & \textbf{Milestone} \\ % \midrule % \endfirsthead % \multicolumn{3}{c}{\tablename~\thetable~-- Work Plan (Aug 2026 -- Jan 2027) (continued)}\\ % \toprule % \textbf{Time Period} & \textbf{Task} & \textbf{Milestone} \\ % \midrule % \endhead % 1 Sep -- 14 Sep & Obtain hardware resources; modify recording setup to detect and synchronise multi-lane signals & Multi-lane-capable recording setup \\ % 15 Sep -- 30 Sep & Record multi-lane DisplayPort emissions & Multi-lane emission recordings \\ % 1 Oct -- 15 Oct & Develop GPU-accelerated reconstruction implementation & - \\ % 16 Oct -- 30 Oct & Begin multi-lane reconstruction pipeline & - \\ % 1 Nov -- 15 Nov & Continue development of multi-lane reconstruction pipeline & Reconstruction pipeline for multi-lane video modes \\ % 16 Nov -- 30 Nov & Continue development of GPU-accelerated reconstruction implementation & GPU-accelerated implementation \\ % 1 Dec -- 15 Dec & Plan and initiate device survey & Device survey plan \\ % 16 Dec -- 31 Dec & Device survey and analysis of results & Device survey results \\ % 1 Jan -- 15 Jan & Technical writeup & Draft writeup \\ % 16 Jan -- 31 Jan & Finalise writeup & Completed writeup \\ % 1 Feb -- 15 Feb & Technical writeup & Draft writeup \\ % 16 Feb -- 28 Feb & Finalise writeup & Completed writeup \\ % \bottomrule % \end{xltabular} \ganttset{ bar label node/.append style={align=right, text width=3.4cm, font=\footnotesize\linespread{0.85}\selectfont}, group label node/.append style={align=right, text width=3.4cm, font=\footnotesize\linespread{0.85}\selectfont}, milestone label node/.append style={align=right, text width=3.4cm, font=\footnotesize\linespread{0.85}\selectfont}, group/.append style={draw=black, fill=gray!40}, bar/.append style={draw=black, fill=gray!20}, milestone/.append style={draw=black, fill=black}, bar height=.6, group height=.6, bar top shift=.2, group top shift=.2, } % Custom colours per theme \definecolor{cMultiLane}{RGB}{70,130,180} % steel blue \definecolor{cGPU}{RGB}{60,160,90} % green \definecolor{cLeap}{RGB}{200,120,40} % orange \definecolor{cSurvey}{RGB}{150,90,180} % purple \definecolor{cEDP}{RGB}{180,60,60} % red \definecolor{cWriteup}{RGB}{90,90,90} % grey % D2 (eDP) theme colours \definecolor{cEM}{RGB}{40,120,160} % blue \definecolor{cRecon}{RGB}{180,60,60} % red \definecolor{cLimit}{RGB}{200,120,40} % orange \definecolor{cKT}{RGB}{60,160,90} % green \begin{ganttchart}[hgrid, vgrid]{1}{20} \gantttitle{Phase 1 (D1) schedule (Oct 2026 -- Mar 2027) --- weeks}{20} \\ \gantttitlelist{1,...,20}{1} \\ % --- Multi-lane reconstruction --- \ganttgroup[group/.append style={fill=cMultiLane}]{Multi-lane reconstruction}{1}{11} \\ \ganttbar[bar/.append style={fill=cMultiLane!25}]{Plan experimental setup and prepare recording scripts}{1}{2} \\ \ganttbar[bar/.append style={fill=cMultiLane!25}]{Record multi-lane emissions}{2}{3} \\ \ganttbar[bar/.append style={fill=cMultiLane!40}]{Develop multi-lane reconstruction pipeline}{4}{11} \\ % --- GPU processing efficiency --- \ganttgroup[group/.append style={fill=cGPU}]{Develop GPU-accelerated implementation}{1}{16} \\ \ganttbar[bar/.append style={fill=cGPU!60}]{Profile CPU pipeline / identify bottlenecks}{1}{3} \\ \ganttbar[bar/.append style={fill=cGPU!60}]{Port core reconstruction pipeline to GPU}{3}{16} \\ % --- Leap byte detection --- \ganttgroup[group/.append style={fill=cLeap}]{Develop leap byte detection methods}{7}{17} \\ \ganttbar[bar/.append style={fill=cLeap!40}]{Survey existing detection algorithms}{7}{12} \\ \ganttbar[bar/.append style={fill=cLeap!40}]{Obtain recordings for testing and evaluation}{9}{13} \\ \ganttbar[bar/.append style={fill=cLeap!40}]{Implement and evaluate alternative detection algorithms}{10}{17} \\ % % --- Extension: survey --- % \ganttgroup[group/.append style={fill=cSurvey}]{(Ext.) Wider target survey}{14}{20} \\ % \ganttbar[bar/.append style={fill=cSurvey!40}]{Plan experiment}{14}{17} \\ % \ganttbar[bar/.append style={fill=cSurvey!40}]{Obtain recordings}{16}{18} \\ % \ganttbar[bar/.append style={fill=cSurvey!40}]{Review findings}{18}{20} \\ % --- Extension: eDP --- \ganttbar[bar/.append style={fill=cEDP}]{(Ext.) eDP feasibility survey}{16}{20} \\ % --- Writeup --- \ganttbar[bar/.append style={fill=cWriteup}]{Technical writeup}{14}{20} \\ \end{ganttchart} \newpage \noindent\textbf{Phase~2 (D2): indicative schedule} \ganttset{ bar label node/.append style={text width=4cm}, group label node/.append style={text width=4cm}, milestone label node/.append style={text width=4cm}, } \begin{ganttchart}[x unit=1.6cm, hgrid, vgrid]{1}{7} \gantttitle{Phase 2 (D2) indicative schedule (e.g.\ Mar 2027 -- Sep 2027) --- months}{7} \\ \gantttitlelist{1,...,7}{1} \\ % --- WP1 EM characterisation --- \ganttgroup[group/.append style={fill=cEM}]{EM characterisation}{1}{2} \\ \ganttbar[bar/.append style={fill=cEM!30}]{Acquire and instrument laptop eDP targets}{1}{2} \\ \ganttbar[bar/.append style={fill=cEM!30}]{Characterise emissions; recover link parameters}{1}{2} \\ \ganttmilestone{EM characterisation report}{2} \\ % --- WP2 Reconstruction feasibility --- \ganttgroup[group/.append style={fill=cRecon}]{Reconstruction feasibility}{2}{5} \\ \ganttbar[bar/.append style={fill=cRecon!30}]{Adapt D1 pipeline to eDP}{2}{3} \\ \ganttbar[bar/.append style={fill=cRecon!30}]{ASSR / alternate-seed investigation}{2}{4} \\ \ganttbar[bar/.append style={fill=cRecon!30}]{Template reconstruction and quality assessment}{3}{5} \\ \ganttmilestone{Feasibility result (go/no-go evidence)}{5} \\ % --- WP3 Technical limitations --- \ganttgroup[group/.append style={fill=cLimit}]{Technical limitations}{4}{6} \\ \ganttbar[bar/.append style={fill=cLimit!40}]{Characterise limits (PSR, DSC, distance, config)}{4}{6} \\ % \ganttmilestone{Limitations and threat report}{6} \\ % --- WP4 Knowledge transfer --- \ganttgroup[group/.append style={fill=cKT}]{Knowledge transfer}{5}{7} \\ \ganttbar[bar/.append style={fill=cKT!40}]{Documentation and codebase handover}{5}{7} \\ % --- Final report --- \ganttbar[bar/.append style={fill=cWriteup}]{Final technical report}{6}{7} \\ \end{ganttchart} % GPU-accelerated implementation work has no dependencies; it may also be a prerequisite for a tractable multi-lane reconstruction pipeline, since a naive implementation could increase attack complexity significantly in the number of target colours. % The device survey is treated as an extension rather than a core deliverable, since it depends on neither multi-lane reconstruction nor GPU acceleration and can be pursued opportunistically if time allows following completion of the core objectives, without risk to the primary timeline. \newpage \bibliographystyle{splncs04} \bibliography{references} \newpage \appendix \end{document}