MITIGATION OF RANSOMWARE ATTACKS
Methods and circuits provide mitigation against ransomware attacks by sampling one or more physical characteristics of a semiconductor device while a ransomware attack is underway. Based on the samples taken during the ransomware attack, the key used in the ransomware attack can be extracted by performing side channel analysis.
1 . A method comprising:
sampling, using management circuitry of a semiconductor device, one or more physical characteristics of the device while a ransomware attack is underway; and
extracting a key used in the ransomware attack, by a key extractor circuit performing side channel analysis on samples of the one or more physical characteristics.
2 . The method of claim 1 , wherein:
the sampling includes sampling the one or more physical characteristics of the semiconductor device as pre-detection samples before detection of the ransomware attack, and sampling the one or more physical characteristics of the semiconductor device as post-detection samples after detection of the ransomware attack; and
the extracting includes performing side channel analysis on the pre-detection samples and the post-detection samples.
3 . The method of claim 2 , wherein storing the pre-detection samples includes maintaining a circular buffer of the pre-detection samples.
4 . The method of claim 1 , further comprising initiating the sampling in response to a signal that indicates the ransomware attack.
5 . The method of claim 1 , wherein the sampling includes sampling by a management circuit on the semiconductor device.
6 . The method of claim 1 , wherein the sampling includes sampling electromagnetic radiation emitted by the semiconductor device.
7 . The method of claim 1 , wherein the key extractor circuit is on the semiconductor device.
8 . The method of claim 1 , wherein extracting the key includes inference processing of the one or more physical characteristics using a machine learning model.
9 . The method of claim 1 , further comprising detecting the ransomware attack and generating a signal that indicates the ransomware attack.
10 . The method of claim 1 , wherein the one or more physical characteristics include one or more of a voltage level, frequency of a clock signal, temperature, and a level of electromagnetic radiation.
11 . A circuit arrangement comprising:
a management circuit configured to sample one or more physical characteristics from a semiconductor device while a ransomware attack is underway; and
a key extractor circuit coupled to receive samples of the one or more physical characteristics and configured to extract a key used in the ransomware attack by performing side channel analysis on the samples.
12 . The circuit arrangement of claim 11 , wherein:
the management circuit is configured to sample the one or more physical characteristics of the semiconductor device as pre-detection samples before detection of the ransomware attack, and sample the one or more physical characteristics of the semiconductor device as post-detection samples after detection of the ransomware attack; and
the key extractor circuit is configured to perform side channel analysis on the pre-detection samples and the post-detection samples.
13 . The circuit arrangement of claim 12 , wherein the management circuit is configured to maintain a circular buffer of the pre-detection samples.
14 . The circuit arrangement of claim 11 , wherein the management circuit is configured to initiate sampling in response to a signal that indicates the ransomware attack is underway.
15 . The circuit arrangement of claim 11 , wherein the management circuit is disposed on the semiconductor device.
16 . The circuit arrangement of claim 11 , wherein the key extractor circuit is disposed on the semiconductor device.
17 . The circuit arrangement of claim 11 , wherein the key extractor circuit is configured to perform inference processing of the one or more physical characteristics using a machine learning model trained for side channel analysis.
18 . The circuit arrangement of claim 11 , further comprising detection circuitry disposed on the semiconductor device and configured to detect the ransomware attack and generate a signal that indicates the ransomware attack is underway.
19 . The circuit arrangement of claim 18 , wherein the detection circuitry implements a machine learning model.
20 . The circuit arrangement of claim 11 , wherein the one or more physical characteristics include one or more of a voltage level, frequency of a clock signal, temperature, and a level of electromagnetic radiation.