Systems and methods for side-channel monitoring of a processor connected to a communication network

1 . A system for monitoring at least one device processor connected to a communication network, the system comprising:

at least one detector configured to generate a program trace signal from at least one side-channel of the at least one device processor;

a communication component to provide access to the communication network; and

at least one monitoring processor in communication with the communication component and the at least one detector, the at least one monitoring processor being configured to:

transmit at least one communication of at least one test message to the at least one device processor via the communication network, wherein the at least one communication of at least one test message comprises at least one communication of a plurality of test messages, the plurality of test messages comprise at least one prior test message and a subsequent test message;

for each communication, collect a program trace signal generated by the at least one device processor in response to the communication;

compare the at least one program trace signal to an expected response of the at least one device processor for the at least one test message to determine whether the at least one program trace signal corresponds to the expected response;

in response to determining that the at least one program trace signal does not correspond to the expected response, generate an anomaly notification; and

select the subsequent test message based on whether a prior program trace signal corresponds to the expected response of the at least one device processor for the at least one prior test message, the prior program trace signal being generated by the at least one device processor in response to a communication of the at least one prior test message.

2 . The system of claim 1 , wherein the at least one monitoring processor is configured to:

determine whether at least one nominal channel of the at least one device processor is responsive to the communication; and

in response to determining that at least one nominal channel is responsive to the communication, determine that the at least one program trace signal corresponds to the expected response.

3 . The system of claim 2 , wherein the at least one nominal channel comprises one or more of an input of the at least one device processor or an output of the at least one device processor.

4 . The system of claim 1 , wherein the at least one monitoring processor is configured to:

determine whether the at least one program trace signal corresponds to an expected program trace signal of the at least one device processor for the test message; and

in response to determining that the at least one program trace signal does not correspond to the expected program trace signal, determine that the at least one program trace signal does not correspond to the expected response.

5 . The system of claim 4 , wherein the expected program trace signal comprises a program trace signal of the at least one device processor when the at least one device processor is idle.

6 . The system of claim 4 , wherein the at least one monitoring processor is configured to:

transmit a plurality of communications of a plurality of preliminary messages to the communication network, the plurality of preliminary messages intended to cause the at least one device processor to be idle;

collect a plurality of preliminary program trace signals generated by the at least one device processor in response to the plurality of communications of the plurality of preliminary messages; and

generate the expected program trace signal based on an average of the plurality of preliminary program trace signals generated in response to the plurality of communications of the preliminary messages.

7 . The system of claim 6 , wherein the plurality of preliminary messages intended to cause the at least one device processor to be idle comprise one or more preliminary messages intended for other device processors connected to the communication network.

8 . The system of claim 1 , wherein:

the at least one communication of at least one test message comprises a plurality of communications of a test message of the at least one test message; and

the at least one monitoring processor is configured to:

generate an average collected program trace signal based on an average of the plurality of program trace signals generated in response to the plurality of communications of the test message;

compare the average collected program trace signal to the expected response of the at least one device processor for the test message; and

in response to determining that the average collected program trace signal does not correspond to the expected response, generate the anomaly notification.

9 . The system of claim 1 , further comprising an envelope generator to detect an active communication on the network that corresponds to a test message transmitted by the at least one monitoring processor; wherein the at least one monitoring processor is configured to collect a program trace signal when the active communication is detected by the envelope generator.

10 . The system of claim 1 , wherein the at least one monitoring processor is configured to select the plurality of test messages randomly.

11 . The system of claim 1 , wherein the at least one monitoring processor is operable configured to select a subsequent test message that is related to the at least one prior test message in response to determining that the prior program trace signal does not correspond to the expected response of the at least one device processor for the at least one prior test message.

12 . The system of claim 11 , wherein the subsequent test message comprises a same command as that of the at least one prior test message and a different value from that of the at least one prior test message.

13 . The system of claim 11 , wherein the subsequent test message comprises a related command as that of the at least one prior test message.

14 . The system of claim 1 , wherein the at least one side-channel comprises one or more of a power consumption, an electromagnetic emission, a magnetic side-channel, an acoustic emanation, or an ultrasound emanation of the at least one device processor.

15 . A method for monitoring at least one device processor connected to a communication network, the method comprising:

operating at least one monitoring processor to transmit at least one communication of at least one test message to the at least one device processor via the communication network wherein the at least one communication of at least one test message comprises at least one communication of a plurality of test messages, the plurality of test messages comprise at least one prior test message and a subsequent test message;

for each communication, generating a program trace signal from at least one side-channel of the at least one device processor in response to the communication; and

operating the at least one monitoring processor to:

for each communication, collect a program trace signal generated by the at least one device processor in response to the communication;

compare the at least one program trace signal to an expected response of the at least one device processor for the at least one test message to determine whether the at least one program trace signal corresponds to the expected response;

in response to determining that the at least one program trace signal does not correspond to the expected response, generate an anomaly notification; and

select the subsequent test message based on whether a prior program trace signal corresponds to the expected response of the at least one device processor for the at least one prior test message, the prior program trace signal being generated by the at least one device processor in response to a communication of the at least one prior test message.

16 . The method of claim 15 , comprising operating the at least one monitoring processor to:

determine whether at least one nominal channel of the at least one device processor is responsive to the communication; and

in response to determining that the least one nominal channel is responsive to the communication, determine that the at least one program trace signal corresponds to the expected response.

17 . The method of claim 16 , wherein the at least one nominal channel comprises one or more of an input of the at least one device processor or an output of the at least one device processor.

18 . The method of claim 15 , comprising operating the at least one monitoring processor to:

determine whether the at least one program trace signal corresponds to an expected program trace signal of the at least one device processor for the test message; and

in response to determining that the at least one program trace signal does not correspond to the expected program trace signal, determine that the at least one program trace signal does not correspond to the expected response.