Discussion
Loading...

Post

  • About
  • Code of conduct
  • Privacy
  • Users
  • Instances
  • About Bonfire
jaseg
@jaseg@chaos.social  ·  activity timestamp 6 days ago

I've got a new paper out on eprint: Monitoring tamper-sensing meshes using low-cost time-domain reflectometry.

In the paper, I wrote up how you can build a ~200 ps resolution time-domain reflectometer from an STM32 and some cheap display bus redriver ICs. The circuit is sensitive enough to distinguish several identical copies of the same test specimen PCB from manufacturing tolerances!

blog post: https://jaseg.de/blog/paper-sampling-mesh-monitor/
paper preprint: https://eprint.iacr.org/2025/1962

#electronics #embedded #security

IACR Cryptology ePrint Archive

High Fidelity Security Mesh Monitoring using Low-Cost, Embedded Time Domain Reflectometry

Security Meshes are patterns of sensing traces covering an area that are used in Hardware Security Modules (HSMs) and other systems to detect attempts to physically intrude into the device's protective shell. State-of-the-art solutions manufacture meshes in bespoke processes from carefully chosen materials, which is expensive and makes replication challenging. Additionally, state-of-the-art monitoring circuits sacrifice either monitoring precision or cost efficiency. In this paper, we present an embeddable security mesh monitoring circuit constructed from low-cost, standard components that utilizes Time Domain Reflectometry (TDR) to create a unique fingerprint of a mesh. Our approach is both low-cost and precise, and enables the use of inexpensive standard Printed Circuit Boards (PCBs) as security mesh material. We demonstrate a working prototype of our TDR circuit costing less than 10 € in components that achieves both time resolution and rise time better than 200 ps—a 25 × improvement over previous work. We demonstrate a simple classifier that detects several types of advanced attacks such as probing using an oscilloscope probe or micro-soldering attacks with no false negatives.

New paper: Monitoring Tamper-Sensing Meshes Using Low-Cost, Embedded Time-Domain Reflectometry | Home

The sampling edges as measured by the board itself. As you can see, using a cheap microcontroller and some cheap display signal redriver ICs along with commodity RF schottkies you can get pretty spicy edges on a budget.
The sampling edges as measured by the board itself. As you can see, using a cheap microcontroller and some cheap display signal redriver ICs along with commodity RF schottkies you can get pretty spicy edges on a budget.
The sampling edges as measured by the board itself. As you can see, using a cheap microcontroller and some cheap display signal redriver ICs along with commodity RF schottkies you can get pretty spicy edges on a budget.
The final setup. On the right is the measurement board, and on the left is the mesh test specimen plugged in. In a real application, you would integrate both into your target circuit.
The final setup. On the right is the measurement board, and on the left is the mesh test specimen plugged in. In a real application, you would integrate both into your target circuit.
The final setup. On the right is the measurement board, and on the left is the mesh test specimen plugged in. In a real application, you would integrate both into your target circuit.
  • Copy link
  • Flag this post
  • Block
Log in

bonfire.cafe

A space for Bonfire maintainers and contributors to communicate

bonfire.cafe: About · Code of conduct · Privacy · Users · Instances
Bonfire social · 1.0.0-rc.3.21 no JS en
Automatic federation enabled
  • Explore
  • About
  • Members
  • Code of Conduct
Home
Login