[Submitted on 5 Mar 2026 (v1), last revised 29 Jul 2026 (this version, v3)]

View PDF HTML (experimental)

Abstract:Electromagnetic (EM) shielding is widely used to suppress radiated emissions and limit passive EM side-channel leakage. However, shielding does not address active probing, where an adversary injects external radio-frequency (RF) signals and observes the device's reflective response. This work studies whether such impedance-modulated backscattering persists when radiated emissions are suppressed by shielding. By injecting controlled RF signals and analyzing the reflections, we demonstrate that state-dependent impedance variations remain observable at frequencies outside the shields' primary attenuation band. Using processors implemented on FPGA and microcontroller prototypes, and evaluating workload profiles under three industry-standard shields, we find that passive EM measurements lose discriminative power under shielding, while backscattering responses remain separable. These results indicate that active RF probing can expose execution-dependent behavior even in shielded systems, motivating the need to consider active impedance-based probing within hardware security evaluation flows.

Submission history

From: Md Sadik Awal [view email]
[v1] Thu, 5 Mar 2026 04:42:39 UTC (1,304 KB)
[v2] Wed, 6 May 2026 19:42:00 UTC (1,304 KB)
[v3] Wed, 29 Jul 2026 01:19:17 UTC (3,971 KB)