Countermeasure for Electromagnetic Screen Image

Leakage based on Color Mixing in Human Brain

Takashi Watanabe #1, Hiroto Nagayoshi #2, Takehiro Urano #3, Toshirou Uemura *4, Hiroshi Sako +5
#
Hitachi Ltd., Central Research Laboratory
1-280 Hitashi-koigakubo, Kokubunji-shi, Tokyo 185-8601, Japan
1 2 3
{ takashi.watanabe.dh, hiroto.nagayoshi.wy, takehiro.urano.pf}@hitachi.com
*
Hitachi-Omron Terminal Solutions, Corp.
1 Ikegami, Haruoka-cho, Owariasahi-shi, Aichi-ken, 488-8501 Japan
4
toshirou_uemura@hitachi-omron-ts.com
+
Hitachi Ltd., Research and Development Strategy Centre, Headquarters
1-6-1 Marunouchi, Chiyoda-ku, Tokyo 100-8220, Japan
5
hiroshi.sako.ug@hitachi.com

Abstract—The security problem of screen image leakage from
a display unit has received wide interest of security researchers
since the Van Eck’s paper. As for the industry side, the problem
is considered a security risk; especially for the computers that
are used in the sensitive business fields, i.e. banking, data center.
To solve this problem, reduction of the emanating signals’ S/N
ratio is important. Therefore, signal reduction and noise
generation methods have been investigated as countermeasure.
We present a method that imposes noise on displayed screen
images, while keeping the quality of the image. This is realized by
utilizing the human characteristic that is known as “Additive
color mixing”, which occurs when the eyes are continuously
exposed to quickly changing colors. By implementing this
method on hardware and software in an ordinary computer
system, we confirmed the effectiveness of our method as a
countermeasure for the electromagnetic screen image leakage.
I. INTRODUCTION
After Van Eck published his paper [9] in 1985, the risk of
information leakage through electromagnetic radiation from a
display unit, not only cathode-ray tube (CRT) but also liquid-
crystal display (LCD), has been widely known. The
information leakage through the electromagnetic radiation is
now referred to as “Compromising emanations”. And its
prevention techniques are referred to as “Emanations security
(EMSEC)”. There is little information on guidelines or
requirements for preventing this kind of information leakage
available in public. However, several companies have been
selling analysis devices for development of countermeasures.
Intercepting electromagnetic waves from ordinary display
units required million-dollar devices in a few decades ago.
Such high-end products cost the same today. However, lower-
range products that cost only several thousands of dollars are
nearly capable of capturing partial information from a few
meters away. This is due to the improvements in radio
management technologies. Furthermore, with rapid advances
of software definition radio (SDR) and field programmable
gate array (FPGA), the cost of information retrieval is
expected to decrease to less than a thousand dollars in the near
future. Because of these changes, development of low-cost
countermeasures that are applicable to ordinary computer
systems is necessary.
Countermeasures are woven to reduce the S/N ratio of
leakage information. These are categorized as signal reduction
and noise generation. For signal reduction, smoothing
functions such as a low-pass filter or Gaussian filter are
applied to screen fonts and entire images [1], [4]. For noise
generation, an additional noise source is placed near to the
sources of signal emission, and in addition they are
synchronized with a pixel clock to cover the frequency range
of information leakage [10]. As a protocol level measure, a
technique that modulates the standard screen timing, that is
defined by VESA [13], is known [8]. Techniques of
randomizing lower significant bits of images to reduce signal
and increases noise concurrently are also proposed [3].
In this paper, we present a method that imposes noise on
displayed screen images, while keeping the quality of the
image. This is realized by utilizing the human characteristic
that is known as “Additive color mixing”, which occurs when
the eyes are continuously exposed to quickly changing colors.
Investigation on how our method affects the intercepted
image was made with a leakage model and an actual
implementation on hardware and software. Detailed strength
and leakage model of electromagnetic radiation from a VDU
is studied by Dong et.al. [5-6], and leakage source and
mechanism is discussed by Pennesi and Sebastiani [7].
However, we restrict ourselves to a simpler model because our
investigation requires only qualitative preciseness. On the
analysis by real devices, effectiveness of the method is
verified with an experimental setup, which we built based on
[2]. The method is implemented as a real-time image
processing device using a FPGA board that is widely available
and as a software application. These are applied to an ordinary
computer system.
In the following section, we describe a leakage model, a
test setup for evaluation, and a preliminary result. In the third
section, we describe the proposed method for preventing
information leakage. The fourth section shows test results.

978-1-4244-6307-7/10/$26.00 ©2010 IEEE 138

 II. LEAKAGE MODEL AND EXPERIMENTAL SETUP Information • CRT
Display Secret • LCD PC
A. Leakage Model
Video Board
The upper half of Fig.2 illustrates a conventional computer Video Cable
Target
system, where a personal computer and CRT or LCD EM wave
Attacker
connected by a video cable. We call this system a “target”. Wave
Antenna
An attacker captures electromagnetic wave that is emanated Generator Secret
from the target. Because the format of picture data transmitted Sync. Result
through the video cable is standardized by VESA, it is easy to Amplifier Signals Display
find candidate frequencies for horizontal and vertical Digital
Receiver Pixel Analyzer PC
synchronization signals. Then, the attacker further searches Value Oscilloscope
for the accurate frequencies by testing one setting by one.
Once the exact frequencies are found, signal processing Fig.2 Setup for Electromagnetic Screen Image Leakage Analysis
techniques are applied to reduce noise to recover the screen
image that was shown on the target VDU. TABLE I
IMAGE DISPLAYED ON VDU, IMAGE CALCULATED, AND IMAGE
Figure 1 illustrates the data structure of analog RGB signal CAPTURED THROUGH ELECTROMAGNETIC WAVE
and corresponding patterns of electromagnetic waves. In an
analog RGB cable, pixel values for three colors, red, green Source Image
and blue, at each screen position are sequentially transmitted
from the left-top of the screen to the right-bottom. This is
called “raster scanning”. These image pixels are composed of
three 8 bit intensity values, and each value is represented by (a) Displayed Image
analog voltage on the color signal lines. As a result, the (on the VDU)
differences of adjacent pixel values stimulate the current in
each color signal line. It emits electromagnetic waves.

Analog RGB cable t-1 t t+1

Rt+1 Rt Rt-1 R
G
･･･ Gt+1 Gt Gt-1 ･･･ (b) Expected Leak Image
Bt+1 Bt Bt-1 B (Calculated by equation (1))

HSync, VSync EM wave

Fig.1 Structure of analog RGB data and electromagnetic wave from the
data sequence. (EM: Electro-Magnetic)

B. Experimental Setup
An experimental setup that is illustrated in Fig.2 is built. (c) Captured Leak Image
The target and the attacker are electronically separated to (Taken from actual device)
avoid any connection except for electromagnetic wave.
The electromagnetic signal becomes to contain more noise
if a distance from the leakage source increases. Therefore, an
attacker usually uses an AM demodulation filter to maximize
the contrast of captured image. This model leads to an
estimation of the power of electromagnetic wave PE(t) for a III. PROPOSED COUNTERMEASURE
pixel value pt at time t and pt-1 at time t-1 with a constant Figure 3 illustrates the structure of proposed method.
positive value a. Firstly, our method receives an input image p and the random
numbers r, and generates two screen images q0 and q1.
PE (t ) = a ⋅ pt − pt −1 (1) Secondly, show q0 and q1 on the screen by swapping them
quickly, which causes the color mixing in human brain.
Table 1 shows a result with the experimental setup. The Because of this, a user who is in from of the screen can
expected leak image (b) is calculated by equation (1) with a=1. recognize the contents of screen image. However an attacker
Although the equation is rather simplified compared to that of who is monitoring the electromagnetic emanation cannot see
[5-6], it represents leakage qualitatively enough. the screen image because the screen image is so randomized
that no information on the image is available through the
electromagnetic emanation.

139
 Input Image p Screen Image Image in human brain
Average value of
pixels’ Intensity
± q0 Eyes q0 + q1
2
Quick
Image in EM wave
Random Flip
numbers r Average value of
EM powers
EM
EM (q0 ) + EM (q1 )
∓ q1 2 = a⋅ | cxt , yt + rxt , yt |
EM: Electro-Magnetic wave
Fig.3 Structure of the proposed countermeasure
In the following, we describe the case where the magnitude
of two successive pixel values leaks. This is the model
described in the previous section.
Our method generates two images from an input image by
adding or subtracting a random value to or from an input pixel
value. These two generated images are constructed so that the
average value of their pixel values at each coordinate equals to
the original pixel’s value. By changing these images quickly
on the screen, a user who is sitting in front of the screen
automatically recognizes the average of these images. This
phenomenon is known as the “Additive color mixing” in
human brain, which is utilized in many applications such as
color enhancement of display units and digital projectors.
We can generalize this method to generate more than three
images from one input image; as long as we can change these
images quickly enough to cause the color mixing. However,
we describe the case of two images in this paper.
In a screen with resolution (w,h), we describe the pixel
value at coordinate (x,y) as px,y. The strength of electro-
magnetic wave W(t) at the time t is written as
W (t ) = a⋅ | pxt , yt − pxt −1 , yt −1 |,
xt = f p ⋅ t mod w, yt = ( f p ⋅ t − xt ) / w mod h,
xt −1 = f p ⋅ (t − 1) mod w, yt −1 = ( f p ⋅ (t − 1) − xt −1 ) / w mod h,
where fp [Hz] is the frequency of pixel clock, a is a parameter
which depends on a leakage source, and we assumed screen
plot starts at the coordinate (0,0) at the time 0.
The two images’ pixel values that are generated from the
input image’s pixel value px,y are written as p 'x , y = px , y − nx , y
and p ''x , y = px , y + nx , y . In these equations, nx,y is a random
number that is generated independently from x and y but a
fixed number for the same coordinate. If we quickly change
these pixels on the screen, the user sees its average value
( p 'x , y + p ''x , y )
= px , y
2 intensity value of each color.
This holds even if we replace x, y by xt and yt of the above
definitions. Therefore, the electromagnetic leakages from
those two screen images become:
140
w '(t ) = a⋅ | p 'xt , yt − p 'xt −1 , yt −1 |
= a⋅ | pxt , yt − nxt , yt − ( pxt −1 , yt−1 − nxt−1 , yt −1 ) |
= a⋅ | cxt , yt − rxt , yt |
and
w ''(t ) = a⋅ | p ''xt , yt − p ''xt −1 , yt −1 |
= a⋅ | pxt , yt + nxt , yt − ( pxt−1 , yt −1 + nxt −1 , yt−1 ) |
respectively. In these equations, we defined and used
cxt , yt = pxt , yt − pxt−1 , yt −1 ,
rxt , yt = nxt , yt − nxt −1 , yt −1
c xt , yt is equivalent to the leakage value in the case without
any countermeasure.
In the ideal case, where the attacker’s synchronization
parameters are equal to the target’s, the attacker can see the
additive average of w' (t ) and w' ' (t ) in his monitor. The
leakage image ( w' (t ) + w' ' (t )) / 2 results in four cases:
1) cxt , yt − rxt , yt ≥ 0 and cxt , yt + rxt , yt ≥ 0
( w '(t ) + w ''(t )) / 2 = a ⋅ c xt , yt
2) cxt , yt − rxt , yt ≥ 0 and cxt , yt + rxt , yt < 0
( w '(t ) + w ''(t )) / 2 = − a ⋅ rxt , yt
3) cxt , yt − rxt , yt < 0 and cxt , yt + rxt , yt ≥ 0
( w '(t ) + w ''(t )) / 2 = a ⋅ rxt , yt
4) cxt , yt − rxt , yt < 0 and cxt , yt + rxt , yt < 0
( w '(t ) + w ''(t )) / 2 = − a ⋅ cxt , yt
In the cases 2 and 3, the attacker only sees the value that is
proportional to the random value. On the other hand, in the
cases 1 and 4, the attacker can see the image that is equivalent
to that without countermeasure. The larger c xt , yt causes the
cases 1 and 4. This result suggests the usage of random values
such that rxt , yt becomes larger if we do not have any previous
knowledge on c xt , yt . It is realized by the following algorithm.
In this algorithm, pi represents the i-th pixel of the input
image from the coordinate (0,0) by following the raster
scanning order. The first screen image u and the second image
v follow the same annotation. The screen resolution is
assumed to be (w,h). And, we assume that the input image is
made of one or more color planes, which contains the
[STEP1] Generate w·h 8-bit random numbers ri that takes a
value between 1 and 255. (If we process a color image, we
generate three sets of random numbers.)
[STEP2] For each color plane and each pixel, change between
the STEP2-a and STEP2-b:
 [STEP2-a] Read the input image’s pixel value pi. Calculate
ui = pi + ri. If ui > 255 holds, set ui = 255. Then calculate
vi = pi – ri. If vi < 0 holds, set vi = 0.
[STEP2-b] Read the input image’s pixel value pi. Calculate
ui = pi – ri. If ui < 0 holds, set ui = 0. Then calculate vi = pi
+ ri. If vi > 255 holds, set vi = 255.
[STEP3] Show the images u and v on the screen by flipping
between them in every 1/60 seconds. (Stay at this step for
the time period the input image p is expected to be shown.)
[STEP4] Go back to STEP2
IV. EXPERIMENTAL RESULT
We implemented our method on a FPGA board and
evaluated it by the experimental setup that is shown in Fig.2.
We used the Altera’s “Cycle III Starter FPGA kit” [11]
with the Bitec’s “DVI Input/Output Card” [12] as the
implementation platform of our image processing method.
The image processor accepts an input image from its video
input port. Then, it outputs a modified image to a display unit.
Since this process is done in real time, the processor can
process a movie. The structure of system is shown in Fig.4.
Image
Computer DVI Processor DVI Display unit
p
qi
(A) FPGA (B)
Fig.4 Real-time image-processing system with FPGA kit
Figure 5 shows two screen images that are generated by our
method. Figure 7 depicts the leakage of two screen images.
They correspond to the captured screen leakages without any
countermeasure (left) and with our countermeasure (right).
To see the difference clearer, the magnified images of “S”
parts are shown in Fig.6. The screen images include strong
noise; however, it is reduced in the averaged image that is
recognised in the human brain.
Fig.5 Two generated screen images from the input image in Table 1(a)
141
(a) (b) (c) (d)
Fig.6 Magnified images of “S” part of (a) the input image, (b) the first
screen image, (c) the second screen image, (d) the average image
The right side of Fig.7 shows the captured screen image
leakage. It is captured at the output line of the image processor
FPGA board (Fig.4 (B)). We cannot see the leakage
information that is visible in the left side of Fig.7 anymore.
Fig.7 The leakage images with/without the countermeasure. These are
captured at the wires after the image processor FPGA board.
The result shown in Fig.7 is taken at the point (B) in Fig.4
to confirm the effectiveness of our method. Although the most
EM leakage power comes from the part after (B), the leakage
from the part (A) still remains. We can reduce this by
implementing our image processor as close to the computer as
possible; we can integrate the function to a video board. To
simulate this solution, we realized the function by software.
Figure 8 shows the screen image of the experimental software.
The quality of the image of left window, which uses our
method, is the same with the original image on the right
window. Moreover, the leakage image, in Fig.9, confirms that
the left window does not leak any information.
The software accepts an image file, then, it generates and
outputs screen images to the display unit. To avoid the
problem of tearing, screen update operation is synchronous to
the vertical synchronization timing (V-sync) that is taken from
a video driver. In the case where a video driver does not
provide the timing information of its V-sync, we can take
another strategy using an external hardware image processor.
An application encrypts a screen image and transfers it to the
image processor. Then, the image processor decrypts it and
generates screen images at the same time. This structure
prevents information leakage from the part of (A) in Fig.4 by
the encryption and (B) by our method.

Fig.8 Image processor software implementation (Left: Image with
countermeasure, Right: Image without countermeasure) Screen image is
captured by a camera
Fig.9 Reconstructed leakage screen image with a countermeasure
window (Left half) and a normal window (Right half)
V. CONCLUSION
In this paper, we showed a countermeasure that uses human
characteristic “Additive color mixing”. Our method reduces
the signal element of an input image by splitting it into
multiple screen images and imposing noise on each screen
image. This results in the increase of noise at the same time.
Consequently, the method prevents information leakage via
the electromagnetic radiation. We verified effectiveness of the
method using an ordinary computer system. In which, a
computer is connected to a display unit by the image
processor FPGA board that modifies input images from the
computer and outputs modified screen images in real-time.
As a countermeasure for electromagnetic security, Kuhn
suggested techniques that cut higher frequency information
142
and randomizes lower significant bits of pixel value that do
not significantly affect the quality of a screen image. However,
these techniques themselves are not fully protective. Since our
method can be implemented independently from these
countermeasures, the countermeasure that is combined with
them is expected to improve security. The FPGA still has
much space for implementing image processing functions. We
will investigate integration of existing countermeasures for the
secure system in the future research.
REFERENCES
[1] H. Tanaka, O. Takizawa and A. Yamamura, “Evaluation and
Improvement of TEMPEST fonts”, Information Security Applications
(WISA2004), LNCS 3325, pp.457-469, 2004
[2] Markus Kuhn, “Compromising emanations: eavesdropping risks of
computer displays”, University of Cambridge Technical Report
Number 577, December 2003
[3] Markus Kuhn, “Electromagnetic Eavesdropping Risks of Flat-Panel
Displays”, 4th Workshop on Privacy Enhancing Technologies, pp.1-20,
2004
[4] Markus Kuhn and Ross Anderson, “Soft Tempest: Hidden Data
Transmission Using Electromagnetic Emanations”, Information Hiding
1998, pp.124-142, 1998
[5] S. Dong, J. Xu and C. Guo, “Bit error rate of a digital radio
eavesdropper on computer CRT monitors”, IEEE International
Symposium on Communications and Information Technology (ISCIT),
vol.2, pp.1093-1099, 2004
[6] S. Dong, J. Xu, H. Zhang and C. Wu, “On compromising emanations
from computer VDU and its interception”, 3rd International
Symposium on Electromagnetic Compatibility, pp.692-695, 2002
[7] S. Pennesi and S. Sebastiani, “Information security and emissions
control”, International Symposium on Electromagnetic Compatibility,
pp.777-781, 2005
[8] T. Watanabe, H. Nagayoshi, H. Sako, and T. Uemura,
“Synchronization Clock Frequency Modulation Technique for
Compromising Emanations Security,” 2009 International Symposium
on Electromagnetic Compatibility, Kyoto, 2009.
[9] Wim van Eck, “Electromagnetic Radiation from Video Display Units:
An Eavesdropping Risk?”, Computers and Security, No.4, pp.269-286,
1985
[10] Y. Suzuki, R. Kobayashi, K.T. M. Masugi, and H. Yamane,
“Development of Countermeasure Device to Prevent Leakage of
Information Caused by Unintentional PC Display Emanations,” Proc.
EUROEM 2008 European Electromagnetics, e177, 2008.
[11] Altera Corporation. http://www.altera.com/
[12] Bitec Ltd. http://www.bitec.ltd.uk/
[13] Monitor Timing Specifications, Version 1.0, Revision 0.8, Video
Electronics Standards Association (VESA), San Jose, California, 1998.