2026-09-22T12:18:30Zhttps://api.repository.cam.ac.uk/server/oai/request

oai:www.repository.cam.ac.uk:1810/2909022021-04-21T19:38:15Zcom_1810_219481com_1810_256065col_1810_219482

Exploiting quasiperiodic electromagnetic radiation using software-defined radio 10.17863/CAM.38085 O'Connell, Christian David Kuhn, Markus Electronic devices emanate unintentional electromagnetic radiation from which an attacker can extract sensitive information. In video display units these are quasiperiodic: nearly periodic in the short term. Video-eavesdropping attacks on these, a main motivation for the use of TEMPEST shielded equipment in security-critical applications, have evolved little since first publicly demonstrated by van Eck in 1985. I investigate digital signal processing techniques that exploit the quasiperiodic nature of digital video signals, with TMDS-encoded data on HDMI/DVI cables as the main example. After first discussing the practicalities of intercepting compromising emanations from the UHF frequency band, using a software-defined radio platform to perform IQ down conversion, I outline the process to carry out a video eavesdropping attack, and methods for rasterising intercepted data. Using a database of video modes, such as VESA and CEA standards, I identify viable eavesdropping targets by fitting likely harmonics of emanating clock signals to a model. Video signals contain blanking intervals that create characteristic periodicities; cepstral features can be used to eliminate false positives, and provide improved performance over autocorrelation as a method of recovering synchronisation frequencies. The signal-to-noise ratio of intercepted emanations is often very poor. Coherent periodic averaging in the complex domain can suppress noise and uncorrelated background sources. I design a phase-locked loop to perform clock recovery and synchronisation of the video signal, negating the effects of temperature drift in the local oscillators. This permits averaging arbitrary-length recordings, increasing the range at which an attack can be performed. I discuss the implications this may have on existing protection standards. Finally, I present a method to recover bandwidths higher than that which the SDR frontend hardware is nominally capable of. I use the cross-correlation between multiple overlapping lower-bandwidth recordings to correct time and phase offsets, and a zero-phase Linkwitz-Riley filter pair to combine them. The resulting higher-bandwidth recordings improve raster clarity, and enable use of a hidden Markov model to recover colour information. University of Cambridge 2019-04-27 Thesis Doctoral Doctor of Philosophy (PhD) en https://www.repository.cam.ac.uk/handle/1810/290902 https://apollo8-f-pro.lib.cam.ac.uk/bitstreams/43faff7a-6bb9-4d01-b8a1-1c6b4e14a4e7/download d7b76d5de9d97be9b70f1cbdd0de39b1 https://apollo8-f-pro.lib.cam.ac.uk/bitstreams/db6e2818-c979-418d-99a4-2db3b8d6f29d/download 87eda9de84448d1f82354d60eee3eb5f https://www.rioxx.net/licenses/all-rights-reserved/ Digital Signal Processing TEMPEST Side-channel attack