Electromagnetic Side Channel Leakage Improvements Using Free-Running Oscillator Clock Reference

Electromagnetic (EM) leakage can be seen near the radio's center frequency when a mixed-signal chip wirelessly transmits data. The undesired signal provides information that can be exploited to decode encrypted data on the chip. This paper looks into how a free-running RC oscillator affects the EM leakage that is being seen through the on-chip radio and compares these results to a clock reference that is similar to a traditional crystal. The purpose of testing a free-running oscillator is to see how a more inconsistent clock reference would affect EM leakage through the radio in hopes of finding an additional countermeasure. The inconsistency of this clock reference is small enough that it is still compatible with IoT communication standards like IEEE 802.15.4. Meaning that devices using this alternative clock reference may not sacrifice any functionality and will have the added benefit of an increase in scalability and a decrease in power consumption. Along with capturing the activity near the carrier, data at the 3rd harmonic (3X the center frequency) is taken. The results of the RC oscillator tests show a decrease in amplitude near the center frequency and no visible EM leakage at 3X the center frequency, with a maximum difference of approximately 6.48 dBm when compared to the crystal-like clock reference. The decrease in signal power causes a reduction in the distance at which the leakage can be exploited. It can be assumed that this type of clock source can be used as a countermeasure, improving the EM side-channel leakage.