Recently, many profiling side-channel attacks based on Machine Learning and Deep Learning have been proposed. Most of them focus on reducing the number of traces required for successful attacks by optimizing the modeling algorithms. In previous work, relatively sufficient traces need to be used for training a model. However, in the practical profiling phase, it is difficult or impossible to collect sufficient traces due to the constraint of various resources. In this case, the performance of profiling attacks is inefficient even if proper modeling algorithms are used. In this paper, the main problem we consider is how to conduct more efficient profiling attacks when sufficient profiling traces cannot be obtained. To deal with this problem, we first introduce the Conditional Generative Adversarial Network (CGAN) in the context of side-channel attacks. We show that CGAN can generate new traces to enlarge the size of the profiling set, which improves the performance of profiling attacks. For both unprotected and protected cryptographic algorithms, we find that CGAN can effectively learn the leakage of traces collected in their implementations. We also apply it to different modeling algorithms. In our experiments, the model constructed with the augmented profiling set can reduce the required attack traces by more than half, which means the generated traces can provide useful information as the real traces.

Deep neural network (DNN) is being adopted in many security-critical and privacy-sensitive smart Internet of Things areas, such as smart city, smart home and intelligent transportation. Therefore, the data privacy of these DNN systems is of great concern. In this paper, we present a new timing side-channel attack, called FPMT attack, to recover the input images of a DNN implemented on microcontrollers. The proposed approach is the first to attack a DNN by exploiting the running time of floating-point multiplications. A passive attacker can obtain the running time from the power consumption trace and then use the time to infer the pixel values without knowing the detailed parameters of the network. Our results show that the FPMT attack can achieve 96.20% recognition accuracy for the MNIST dataset. When the inputs are handwritten digits or letters, attackers can even know what you write with the recovered images. This work puts forward a new direction of attacks on DNN and can be extended to more scenarios.