A real-time interception system for compromised frequency-hopping signal eavesdropping

In modern computing architectures, sensitive data ( red data ) is carried out in the same processing units as encrypted data ( black data ). Due to leaks (internal mixing, coupling …), this red data can be emitted in a legitimate radio transmission through a so-called telecom side-channel. This new type of side-channel creates an important threat as it can be passively and remotely processed by a dedicated interception system. This threat becomes even more concerning within the context of the Internet of Things, as the use of low-cost components leads to increased leaks. This paper addresses telecom side-channels on frequency-hopping signals, that are harsh to eavesdrop due to their sporadic nature in both time and frequency domains. To that goal, a wideband interception system is proposed, able to intercept frequency-hopping signals in real time and to extract sensitive red data from it. The system relies on software-defined radios and leverages both hardware and software resources to process a 200MHz bandwidth in real time. The proposed architecture is capable of detecting jumps on the order of 20 μ s and can therefore track 50,000 jumps per second across 1,024 channels. Finally, the criticality of telecom side-channels in Bluetooth communications is demonstrated through real interception on several microcontroller chips.