Analog input pins can leak data through unexpected signal paths
Analog Pin Directionality as an Exfiltration Attack Surface in Mixed-Signal ICs
Cryptography and SecurityHardware Architecture
Summary
Some computer chips use pins meant only for inputting signals, but this research finds these pins can unintentionally send data out. The authors show a way that certain circuit setups can turn an input pin into a hidden communication channel, potentially leaking information. They tested this idea on a real chip used for measuring vital signs and confirmed data could escape through the input pin without easy detection. This suggests chip makers should check not just how signals normally flow, but also how pins might be misused to leak data.
What this means in practice
- •For hardware security engineers: Identify and test for hidden data leaks through nominally input-only analog pins in mixed-signal ICs during chip design and validation.
- •For biosensor device developers: Improve security of biosensing chips by verifying that sensor input pins cannot be exploited as covert data channels.
Authors
Ramana Ranganatham, Chirag Adiga, Michael Zuzak, Tejasvi Das
Abstract
Mixed-signal SoCs rely on nominally input-only analog pins to acquire off-chip signals, but the directionality of these interfaces is generally treated as a functional property rather than explicitly verified as a security property. This work identifies and experimentally demonstrates a directionality-based class of analog and mixed-signal (AMS) exfiltration attacks in which data-dependent circuit-offset modulation converts a nominally input-only pin into an outbound information channel. We analytically model the attack mechanism and identify three enabling host conditions: a closed-loop amplifier, an exposed amplifier input, and sufficiently high impedance at that pin. This attack class is validated through a representative silicon case study using a photoplethysmography (PPG) analog front-end (AFE) fabricated in a commercial 55-nm CMOS process. The payload incurs $<$0.001\% area overhead relative to typical biosensing AFEs. Under the evaluated conditions, payload activation reduces the filtered PPG-output SNR by only 0.03~dB, while the maximum HT-induced perturbation of 5.9\% of the PPG amplitude remains within the 34.3\% benign variation at the exposed sensor-input pin across process and temperature. The raw exfiltration SINR remains below -20~dB, while targeted filtering increases it above 14~dB and enables signal recovery. Silicon measurements demonstrate data exfiltration through the input pin at bit rates up to 10~kbps and error-free recovery of a PRBS message. These results expose a conventional test-observability gap and establish analog pin directionality as an AMS security property requiring explicit verification, test coverage, and defense rather than being inferred from nominal signal flow.