@article {18568,
	title = {Towards Low Energy Stream Ciphers},
	journal = {IACR Transactions on Symmetric Cryptology},
	year = {In Press},
	author = {Banik, Subhadeep and Mikhalev, Vasily and Armknecht, Frederik and Isobe, Takanori and Meier, Willi and Bogdanov, Andrey and Watanabe, Yuhei and Regazzoni, Francesco}
}
@inbook {18529,
	title = {Extinguishing Ransomware - A Hybrid Approach to Android Ransomware Detection},
	booktitle = {Foundations and Practice of Security},
	volume = {10723},
	year = {2018},
	month = {02/2018},
	pages = {242-258},
	publisher = {Springer International Publishing},
	organization = {Springer International Publishing},
	address = {Cham},
	abstract = {Mobile ransomware is on the rise and effective defense from it is of utmost importance to guarantee security of mobile users{\textquoteright} data. Current solutions provided by antimalware vendors are signature-based and thus ineffective in removing ransomware and restoring the infected devices and files. Also, current state-of-the art literature offers very few solutions to effectively detecting and blocking mobile ransomware. Starting from these considerations, we propose a hybrid method able to effectively counter ransomware. The proposed method first examines applications to be used on a device prior to their installation (static approach) and then observes their behavior at runtime and identifies if the system is under attack (dynamic approach). To detect ransomware, the static detection method uses the frequency of opcodes while the dynamic detection method considers CPU usage, memory usage, network usage and system call statistics. We evaluate the performance of our hybrid detection method on a dataset that contains both ransomware and legitimate applications. Additionally, we evaluate the performance of the static and dynamic stand-alone methods for comparison. Our results show that although both static and dynamic detection methods perform well in detecting ransomware, their combination in a form of a hybrid method performs best, being able to detect ransomware with 100{\%} precision and having a false positive rate of less than 4{\%}.},
	isbn = {978-3-319-75650-9},
	doi = {https://doi.org/10.1007/978-3-319-75650-9_16},
	author = {Ferrante, Alberto and Malek, Miroslaw and Martinelli, Fabio and Mercaldo, Francesco and Milosevic, Jelena},
	editor = {Imine, Abdessamad and Fernandez, Jos{\'e} M. and Marion, Jean-Yves and Logrippo, Luigi and Garcia-Alfaro, Joaquin}
}
@conference {18574,
	title = {Inverse Gating for Low Energy Block Ciphers},
	booktitle = {Proceedings of the IEEE International Symposium on Hardware Oriented Security and Trust (HOST)},
	year = {2018},
	author = {Banik, Subhadeep and Bogdanov, Andrey and Isobe, Takanori and Hiwatari, Harunaga and Akishita, Toru and Regazzoni, Francesco}
}
@conference {18486,
	title = {Instruction Set Extensions for secure applications},
	booktitle = {Design, Automation Test in Europe Conference DATE 2016},
	year = {2016},
	month = {03/2016},
	pages = {1529-1534},
	publisher = {IEEE},
	organization = {IEEE},
	address = {Dresden, Germany},
	abstract = {The main goal of this paper is to expose the community to past achievements and future possible uses of Instruction Set Extension (ISE) in security applications. Processor customization has proven to be an effective way for achieving high performance with limited area and energy overhead for several applications, ranging from signal processing to graphical computation. Concerning cryptographic algorithms, a large body of work exists on speeding up block ciphers and asymmetric cryptography with specific ISEs. These algorithms often mix non-standard operations with regular ones, thus representing an ideal target for being accelerated with dedicated instructions. Tools supporting automatic generations of ISEs demonstrated to be useful for algorithm exploration, while secure instructions can increase the robustness against side channels attacks of software routines. In this paper, we discuss how processor customization and the relative tool chains can be used by designers to address security problems and we highlight possible research directions},
	keywords = {asymmetric cryptography, block ciphers, cryptographic algorithms protection, instruction set, security applications},
	isbn = {978-3-9815-3707-9},
	url = {http://ieeexplore.ieee.org/xpl/freeabs_all.jsp?arnumber=7459556},
	author = {Regazzoni, Francesco and Ienne, Paolo}
}
@conference {18484,
	title = {Round gating for low energy block ciphers},
	booktitle = {2016 IEEE International Symposium on Hardware Oriented Security and Trust, HOST},
	year = {2016},
	month = {05/2016},
	pages = {55-60},
	publisher = {IEEE Computer Society},
	organization = {IEEE Computer Society},
	address = {McLean, VA, USA},
	abstract = {Pushed by the pervasive diffusion of devices operated by battery or by the energy harvested, energy has become one of the most important parameter to be optimized for embedded systems. Particularly relevant would be to optimize the energy consumption of security primitives. In this paper we explore design techniques for implementing block ciphers in a low energy fashion. We concentrate on round based implementation and we discuss how gating, applied at round level can affect and improve the energy consumption of the most common lightweight block cipher currently used in the internet of things. Additionally, we discuss how to needed gating wave can be generated. Experimental results show that our technique is able to reduce the energy consumption in most block ciphers by over 60\% while incurring only a minimal overhead in hardware},
	keywords = {algorithm design and analysis, ciphers, clocks, computer architecture, energy consumption},
	isbn = {978-1-4673-8826-9},
	doi = {10.1109/HST.2016.7495556},
	url = {http://dx.doi.org/10.1109/HST.2016.7495556},
	author = {Banik, Subhadeep and Bogdanov, Andrey and Regazzoni, Francesco and Isobe, Takanori and Hiwatari, Harunaga and Akishita, Toru}
}
@article {18482,
	title = {Automatic Application of Power Analysis Countermeasures},
	journal = {IEEE Transactions on Computers },
	volume = {64},
	issue = {2},
	year = {2015},
	month = {02/2015},
	pages = {329-341},
	type = {journal},
	chapter = {329},
	abstract = {We introduce a compiler that automatically inserts software countermeasures to protect cryptographic algorithms against power-based side-channel attacks. The compiler first estimates which instruction instances leak the most information through side-channels. This information is obtained either by dynamic analysis, evaluating an information theoretic metric over the power traces acquired during the execution of the input program, or by static analysis. As information leakage implies a loss of security, the compiler then identifies (groups of) instruction instances to protect with a software countermeasure such as random precharging or Boolean masking. As software protection incurs significant overhead in terms of cryptosystem runtime and memory usage, the compiler protects the minimum number of instruction instances to achieve a desired level of security. The compiler is evaluated on two block ciphers, AES and Clefia; our experiments demonstrate that the compiler can automatically identify and protect the most important instruction instances. To date, these software countermeasures have been inserted manually by security experts, who are not necessarily the main cryptosystem developers. Our compiler offers significant productivity gains for cryptosystem developers who wish to protect their implementations from side-channel attacks},
	keywords = {cryptographic algorithms protection, cryptography, data protection, power analysis attacks, program compilers, side-channel attacks},
	issn = {0018-9340},
	doi = {10.1109/TC.2013.219},
	url = {http://dx.doi.org/10.1109/TC.2013.219},
	author = {Bayrak, Ali Galip and Regazzoni, Francesco and Novo, David and Brisk, Philip and Standaert, Fran{\c c}ois-Xavier and Ienne, Paolo}
}
@conference {18483,
	title = {Midori: A Block Cipher for Low Energy},
	booktitle = {21st International Conference on the Theory and Application of Cryptology and Information Security ASIACRYPT 2015},
	series = {Lecture Notes in Computer Science},
	volume = {9453},
	year = {2015},
	month = {11/2015},
	pages = {411-436},
	publisher = {Springer Berlin Heidelberg},
	organization = {Springer Berlin Heidelberg},
	address = {Auckland, New Zealand},
	abstract = {In the past few years, lightweight cryptography has become a popular research discipline with a number of ciphers and hash functions proposed. The designers{\textquoteright} focus has been predominantly to minimize the hardware area, while other goals such as low latency have been addressed rather recently only. However, the optimization goal of low energy for block cipher design has not been explicitly addressed so far. At the same time, it is a crucial measure of goodness for an algorithm. Indeed, a cipher optimized with respect to energy has wide applications, especially in constrained environments running on a tight power/energy budget such as medical implants.

This paper presents the block cipher Midori (The name of the cipher is the Japanese translation for the word Green.) that is optimized with respect to the energy consumed by the circuit per bt in encryption or decryption operation. We deliberate on the design choices that lead to low energy consumption in an electrical circuit, and try to optimize each component of the circuit as well as its entire architecture for energy. An added motivation is to make both encryption and decryption functionalities available by small tweak in the circuit that would not incur significant area or energy overheads. We propose two energy-efficient block ciphers Midori128 and Midori64 with block sizes equal to 128 and 64 bits respectively. These ciphers have the added property that a circuit that provides both the functionalities of encryption and decryption can be designed with very little overhead in terms of area and energy. We compare our results with other ciphers with similar characteristics: it was found that the energy consumptions of Midori64  and Midori128  are by far better when compared ciphers like PRINCE and NOEKEON.
},
	keywords = {lightweight block cipher, low energy circuits},
	isbn = {978-3-662-48799-0},
	issn = {0302-9743},
	doi = {10.1007/978-3-662-48800-3_17},
	url = {http://dx.doi.org/10.1007/978-3-662-48800-3_17},
	author = {Banik, Subhadeep and Bogdanov, Andrey and Isobe, Takanori and Shibutani, Kyoji and Hiwatari, Harunaga and Akishita, Toru and Regazzoni, Francesco}
}
@article {18472,
	title = {Midori: (A) Block Cipher for Low Energy (Extended Version)},
	journal = {(IACR) Cryptology ePrint Archive},
	volume = {2015},
	year = {2015},
	month = {12/2015},
	chapter = {1142},
	abstract = {In the past few years, lightweight cryptography has become a popular research discipline with a number of ciphers and hash functions proposed. The designers{\textquoteright} focus has been predominantly to minimize the hardware area, while other goals such as low latency have been addressed rather recently only. However, the optimization goal of low energy for block cipher design has not been explicitly addressed so far. At the same time, it is a crucial measure of goodness for an algorithm. Indeed, a cipher optimized with respect to energy has wide applications, especially in constrained environments running on a tight power/energy budget such as medical implants. 

This paper presents the block cipher Midori that is optimized with respect to the energy consumed by the circuit per bit in encryption or decryption operation. We deliberate on the design choices that lead to low energy consumption in an electrical circuit, and try to optimize each component of the circuit as well as its entire architecture for energy. An added motivation is to make both encryption and decryption functionalities available by small tweak in the circuit that would not incur significant area or energy overheads. 

We propose two energy-efficient block ciphers Midori128 and Midori64 with block sizes equal to 128 and 64 bits respectively. These ciphers have the added property that a circuit that provides both the functionalities of encryption and decryption can be designed with very little overhead in terms of area and energy. We compare our results with other ciphers with similar characteristics: it was found that the energy consumptions of Midori64 and Midori128 are by far better when compared ciphers like PRINCE and NOEKEON. 
},
	keywords = {AES, lightweight block cipher, low energy circuits, secret-key cryptography},
	url = {http://eprint.iacr.org/2015/1142},
	author = {Regazzoni, Francesco and Banik, Subhadeep and Bogdanov, Andrey and Isobe, Takanori and Shibutani, Kyoji and Hiwatari, Harunaga and Akishita, Toru}
}
@article {18060,
	title = {Automatic Application of Power Analysis Countermeasures},
	journal = {IEEE Transactions on Computers},
	volume = {PP},
	issue = {99},
	year = {2013},
	month = {12/2013},
	abstract = {We introduce a compiler that automatically inserts software countermeasures to protect cryptographic algorithms against power-based side-channel attacks. The compiler first estimates which instruction instances leak the most information through side-channels. This information is obtained either by dynamic analysis, evaluating an information theoretic metric over the power traces acquired during the execution of the input program, or by static analysis. As information leakage implies a loss of security, the compiler then identifies (groups of) instruction instances to protect with a software countermeasure such as random precharging or Boolean masking. As software protection incurs significant overhead in terms of cryptosystem runtime and memory usage, the compiler protects the minimum number of instruction instances to achieve a desired level of security. The compiler is evaluated on two block ciphers, AES and Clefia; our experiments demonstrate that the compiler can automatically identify and protect the most important instruction instances. To date, these software countermeasures have been inserted manually by security experts, who are not necessarily the main cryptosystem developers. Our compiler offers significant productivity gains for cryptosystem developers who wish to protect their implementations from side-channel attacks.},
	issn = {0018-9340},
	doi = {10.1109/TC.2013.219},
	author = {Bayrak, Ali Galip and Regazzoni, Francesco and Novo Bruna, David and Brisk, Philip and Standaert, Fran{\c c}ois-Xavier and Ienne, Paolo}
}
@conference {18072,
	title = {An eda-friendly protection scheme against side-channel attacks},
	booktitle = {Design, Automation and Test in Europe (DATE)},
	year = {2013},
	month = {March},
	address = {Grenoble, France},
	author = {Bayrak, Ali Galip and Velickovic, Nikola and Regazzoni, Francesco and Novo Bruna, David and Brisk, Philip and Ienne, Paolo}
}
@conference {18066,
	title = {Sleuth: Automated Verification of Software Power Analysis Countermeasures},
	booktitle = {Workshop on Cryptographic Hardware and Embedded Systems (CHES)},
	year = {2013},
	month = {August},
	address = {Santa Barbara, California, USA},
	author = {Bayrak, Ali Galip and Regazzoni, Francesco and Novo Bruna, David and Ienne, Paolo}
}
@conference {18075,
	title = {Compact Implementation and Performance Evaluation of Block Ciphers in ATtiny Devices},
	booktitle = {Progress in Cryptology - Africacrypt},
	year = {2012},
	month = {July},
	address = {Ifrance, Morocco},
	author = {Eisenbarth, Thomas and Gong, Zheng and Gneysu, Tim and Heyse, Stefan and Indesteege, Sebastiaan and Kerckhof, St{\'e}phanie and Koeune, Francois and Nad, Tomislav and Plos, Thomas and Regazzoni, Francesco and Standaert, Fran{\c c}ois-Xavier and Oldenzeel, Loic Van Oldene}
}
@inbook {18062,
	title = {Interaction between Fault Attack Countermeasures and the Resistance against Power Analysis Attacks},
	booktitle = {Fault Analysis in Cryptography},
	series = {Information Security and Cryptography Series, Springer},
	year = {2012},
	pages = {257-272},
	publisher = {Springer Berlin Heidelberg},
	organization = {Springer Berlin Heidelberg},
	abstract = {Most of the countermeasures against fault attacks on cryptographic systems that have been developed so far are based on the addition of information redundancy. While these countermeasures have been evaluated with respect to their cost (implementation overhead) and efficiency (fault coverage), little attention has been devoted to the question of the impact their use has on the effectiveness of other types of side-channel attacks, in particular, power analysis attacks. This chapter presents an experimental study whose goal is to determine whether the added information redundancy can increase the vulnerability of a cryptographic circuit to power analysis attacks.},
	isbn = {978-3-642-29656-7},
	doi = {10.1007/978-3-642-29656-7_15},
	author = {Regazzoni, Francesco and Breveglieri, Luca and Ienne, Paolo and Koren, Israel},
	editor = {Joye, Marc and Tunstall, Michael}
}
@conference {18080,
	title = {A First Step Towards Automatic Application of Power Analysis Countermeasures},
	booktitle = {48th Design Automation Conference (DAC)},
	year = {2011},
	month = {June},
	address = {San Diego, Califorina},
	author = {Bayrak, Ali Galip and Regazzoni, Francesco and Brisk, Philip and Standaert, Fran{\c c}ois-Xavier and Ienne, Paolo}
}
@conference {18081,
	title = {Power-Gated MOS Current Mode Logic (PG-MCML): A Power-Aware DPA-Resistant Standard Cell Library},
	booktitle = {48th Design Automation Conference (DAC)},
	year = {2011},
	month = {June},
	address = {San Diego, Califorina},
	author = {Cevrero, Alessandro and Regazzoni, Francesco and Schwander, Michael and Badel, St{\'e}phane and Ienne, Paolo and Leblebici, Yusuf}
}
@inbook {18085,
	title = {A Design Flow and Evaluation Framework for DPA-resistant Instruction Set Extensions},
	booktitle = {Cryptographic Hardware and Embedded Systems (CHES)},
	series = {Lecture Notes in Computer Science},
	volume = {5747},
	year = {2009},
	month = {September},
	pages = {205-219},
	publisher = {Springer Berlin Heidelberg},
	organization = {Springer Berlin Heidelberg},
	address = {Lausanne, Switzerland},
	abstract = {Power-based side channel attacks are a significant security risk, especially for embedded applications. To improve the security of such devices, protected logic styles have been proposed as an alternative to CMOS. However, they should only be used sparingly, since their area and power consumption are both significantly larger than for CMOS. We propose to augment a processor, realized in CMOS, with custom instruction set extensions, designed with security and performance as the primary objectives, that are realized in a protected logic. We have developed a design flow based on standard CAD tools that can automatically synthesize and place-and-route such hybrid designs. The flow is integrated into a simulation and evaluation environment to quantify the security achieved on a sound basis. Using MCML logic as a case study, we have explored different partitions of the PRESENT block cipher between protected and unprotected logic. This experiment illustrates the tradeoff between the type and amount of application-level functionality implemented in protected logic and the level of security achieved by the design. Our design approach and evaluation tools are generic and could be used to partition any algorithm using any protected logic style.},
	isbn = {978-3-642-04137-2},
	doi = {10.1007/978-3-642-04138-9_15},
	author = {Regazzoni, Francesco and Cevrero, Alessandro and Standaert, Fran{\c c}ois-Xavier and Badel, St{\'e}phane and Kluter, Theo and Brisk, Philip and Leblebici, Yusuf and Ienne, Paolo}
}
@article {18064,
	title = {Evaluating Resistance of MCML Technology to Power Analysis Attacks Using a Simulation-Based Methodology},
	journal = {Springer Transactions on Computational Science},
	volume = {5430},
	year = {2009},
	month = {February},
	pages = {230{\textendash}243},
	author = {Regazzoni, Francesco and Eisenbarth, Thomas and Poschmann, Axel and Groschdl, Johann and Gurkaynak, Frank and Macchetti, Marco and Toprak, Zeynep and Pozzi, Laura and Paar, Christof and Leblebici, Yusuf and Ienne, Paolo}
}
@conference {89.ReEiBrIeKo,
	title = {Can knowledge regarding the presence of countermeasures against fault attacks simplify power attacks on cryptographic devices?},
	booktitle = {Proceedings of 23rd IEEE International Symposium on Defect and Fault Tolerance in VLSI Systems (DFTS 08)},
	year = {2008},
	month = {October 1-3},
	abstract = {Side-channel attacks are nowadays a serious concern when implementing cryptographic algorithms. Powerful ways for gaining information about the secret key as well as various countermeasures against such attacks have been recently developed. Although it is well known that such attacks can exploit information leaked from different sources, most prior works have only addressed the problem of protecting a cryptographic device against a single type of attack. Consequently, there is very little knowledge on how a scheme for protecting a device against one type of side-channel attack may affect its vulnerability to other types of side-channel attacks. In this paper we focus on devices that include protection against fault injection attacks (using different error detection schemes) and explore whether the presence of such fault detection circuits affects the resistance against attacks based on power analysis. Using the AES S-Box as an example, we performed attacks on the unprotected implementation as well as modified implementations with parity check circuits or residue check circuits (mod3 and mod7). In particular, we focus on the question whether the knowledge of the presence of error detection circuitry in the cryptographic device can help an attacker who attempts to mount a power attack on the device. Our results show that the presence of error detection circuitry helps the attacker even if he is unaware of this circuitry, and that the benefit to the attacker increases with the number of check bits used for the purpose of error detection.},
	author = {Regazzoni, Francesco and Eisenbarth, Thomas and Breveglieri, Luca and Ienne, Paolo and Koren, Israel}
}
@conference {67.ReEiGr07,
	title = {Power Attacks Resistance of Cryptographic S-boxes with added Error Detection Circuits},
	booktitle = {proceedings of: {\textquoteright}22nd IEEE International Symposium on Defect and Fault Tolerance in VLSI Systems (DFT{\textquoteright}07)},
	year = {2007},
	month = {September 26-28},
	address = {Rome, Italy},
	abstract = {Many side-channel attacks on implementations of cryptographic algorithms have been developed in recent years demonstrating the ease of extracting the secret key. In response, various schemes to protect cryptographic devices against such attacks have been devised and some implemented in practice. Almost all of these protection schemes target an individual side-channel attack and consequently, it is not obvious whether a scheme for protecting the device against one type of side-channel attacks may make the device more vulnerable to another type of side-channel attacks. We examine in this paper the possibility of such a negative impact for the case where fault detection circuitry is added to a device (to protect it against fault injection attacks) and analyze the resistance of the modified device to power attacks. To simplify the analysis we focus on only one component in the cryptographic device (namely, the S-box in the AES and Kasumi ciphers), and perform power attacks on the original implementation and on a modified implementation with an added parity check circuit. Our results show that the presence of the parity check circuitry has a negative impact on the resistance of the device to power analysis attacks.},
	keywords = {cryptography, fault tolerance, reliable applications, side channel attacks},
	author = {Regazzoni, Francesco and Eisenbarth, Thomas and Gro{\ss}sch{\"a}dl, Johann and Breveglieri, Luca and Ienne, Paolo and Koren, Israel and Paar, Christof}
}
@conference {69.BoIoNeTaTo07,
	title = {Role Based Access Control for the interaction with Search Engines},
	booktitle = {COOPER Workshop in conjunction with EC-TEL07 Conference},
	year = {2007},
	month = {September 17},
	abstract = {Search engine-based features are a basic interaction mean for users to find information inside a Web-based Learning Management Systems (LMS); nonetheless, traditional solutions lack in mechanisms for access rights management for data contained in search engines{\textquoteright} indexes. This paper explores the integration of a Role Based Access Control (RBAC) mechanism for the interaction with a search engine in a Web-based LMS. We first outline a reference conceptual model for the design of Web-based LMSs exploiting RBAC by means of WebML, a visual modeling language for the high-level specification of data-intensive Web applications. Then, we propose a model-driven approach for the definition of a RBAC-driven interaction between users and search engines, extending WebML with new modeling primitives and outlining significative modeling patterns for the specification of the visibility and action access control levels.},
	keywords = {access control modeling, index modeling, search engine design, web engineering},
	author = {Bozzon, Alessandro and Iofciu, Tereza and Nejdl, Wolfgang and Taddeo, Antonio Vincenzo and Tonnies, Sascha}
}
@conference {59.ReBaEi07,
	title = {Simulation-based Methodology for Evaluating DPA-Resistance of Cryptographic Functional Units with Application to CMOS and MCML Technologies},
	booktitle = {International Conference on Embedded Computer Systems: Architectures, Modeling, and Simulation (SAMOS IC 07)},
	year = {2007},
	month = {July 16-19},
	address = {Samos, Greece},
	abstract = {This paper explores the resistance of MOS Current Mode Logic (MCML) against Differential Power Analysis (DPA) attacks. Circuits implemented in MCML, in fact, have unique characteristics both in terms of power consumption and the dependency of the power profile from the input signal pattern. Therefore, MCML is suitable to protect cryptographic hardware from DPA and similar side-channel attacks. In order to demonstrate the effectiveness of different logic styles against power analysis attacks, the non-linear bijective function of the Kasumi algorithm (known as substitution box S7) was implemented with CMOS and MCML technology, and a set of attacks was performed using power traces derived from SPICE-level simulations. Although all keys were discovered for CMOS, only very few attacks to MCML were successful.},
	keywords = {current mode logic (CML), differential power analysis (DPA), power simulation, side channel attacks},
	author = {Regazzoni, Francesco and Badel, St{\'e}phane and Eisenbarth, Thomas and Gro{\ss}sch{\"a}dl, Johann and Poschmann, Axel and Toprak, Zeynep and Macchetti, Marco and Pozzi, Laura and Paar, Christof and Leblebici, Yusuf and Ienne, Paolo}
}
