System and method for detecting activities within a bootstrap of a computerized device based on monitoring of power consumption

• US 10,296,740 B2
• Filed: 05/13/2015
• Issued: 05/21/2019
• Est. Priority Date: 05/18/2014
• Status: Active Grant

• Current Assignee: B.G. Negev Technologies And Applications Ltd (Ben Gurion University of The Negev)
• Original Assignee: B.G. Negev Technologies And Applications Ltd (Ben Gurion University of The Negev)
• Inventors: Guri, Mordechai, Elovici, Yuval
• Primary Examiner(s): Johnson, Terrell S
• Application Number:
  US15/309,477
• Publication Number:
  US 20170185770A1
• Time in Patent Office: 1,469 Days
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 21/755 with measures against power attack
• CPC Class Codes: G06F 21/81 by operating on the power supply, e.g. enabling or disabling power-on, sleep or resume operations
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 9/4401 Bootstrapping security arrangements therefor G06F21/57
• CPC Class Codes: G06F 9/4406 Loading of operating system

Abstract

The invention relates to a system for protecting a computerized device from activities within the device bootstrap, which comprises: (a) a DC supply monitoring unit for monitoring power consumption of the DC supply of the device during bootstrap; and (b) a database for storing one or more valid bootstrap signatures, each of said valid bootstrap signatures describes a valid variation of power consumption pattern, respectively, from the DC supply of the device; wherein, during bootstrapping of the device, said DC supply monitoring unit continuously monitors the power consumption from said DC supply of the device, compares characteristics of the power consumption with said one or more valid bootstrap signatures in said database, and alerts upon detection of a mismatch.

Claims

1. A system for protecting a computerized device from activities within a device bootstrap, which comprises:

a) a DC supply monitoring unit for monitoring power consumption of a DC supply of the device during bootstrap; and

b) a database for storing one or more valid bootstrap signatures, each of said valid bootstrap signatures describes a valid variation of power consumption pattern, respectively, from the DC supply of the device;

wherein, during bootstrapping of the device, said DC supply monitoring unit continuously monitors the power consumption from said DC supply of the device, compares characteristics of the power consumption with said one or more valid bootstrap signatures in said database, and alerts upon detection of a mismatch;

wherein said DC supply monitoring unit is separated and isolated both physically and logically in terms of connectivity from hardware and software of a computerized environment of the device, and wherein said DC supply monitoring unit is at most physically connected to the DC supply of the device.

2. The system according to claim 1, wherein said database further stores one or more invalid or malicious bootstrap signatures, each of said invalid or malicious bootstrap signatures describes invalid or malicious variation of power consumption pattern, respectively, from the DC supply of the device, and wherein during bootstrapping of the device, said DC supply monitoring unit continuously monitors the power consumption from said DC supply of the device, compares characteristics of the power consumption with said one or more valid and invalid bootstrap signatures in said database, respectively, and alerts upon detection of a mismatch or match, respectively.

3. The system according to claim 1, wherein said signatures are created based on an offline learning process on a valid bootstrap pattern, said learning process involves running of the bootstrap one or more times, and use of pattern recognition or machine learning techniques.

4. The system according to claim 1, which is positioned on a printed circuit which is separated both physically and logically from electronic circuitry of said monitored computerized device, and wherein said system comprises a dedicated microprocessor on said separated printed circuit.

5. The system according to claim 1, wherein said DC supply monitoring unit is positioned on a separate printed circuit, and wherein said microprocessor bases its monitoring on sampling of a current consumption from said DC supply.

6. The system according to claim 1, wherein said DC supply monitoring unit forms a trusted execution environment which is at least logically separated from a main operating system of the device.

7. The system according to claim 1, wherein said computerized device is a mobile device, and wherein said DC supply is a battery of the device.

8. The system according to claim 1, wherein said computerized device is a stationary device, and wherein said DC supply is a DC power supply of the device.

9. The system according to claim 1, wherein each of said valid bootstrap signatures comprises marks that are intentionally introduced to within a bootstrap code, each of said marks reflects a specific, known, and distinguishable shape of a signal in terms of power consumption from the DC supply.

10. The system according to claim 1, wherein said comparison uses pattern recognition techniques or machine learning techniques.

11. The system according to claim 1, wherein said alert is provided via a wired network interface.

12. The system according to claim 1, wherein said alert is provided via a wireless network interface.

13. The system according to claim 1, wherein said alert is provided by visual means, audible means, or a combination thereof.

14. The system according to claim 4, wherein said alert is provided by alert means that are positioned within said separated printed circuit.

15. The system according to claim 13, wherein said visual means is a light emitting diode, and said audible means is a speaker.

16. The system according to claim 13, wherein said visual means is an external screen or touch screen.

17. The system according to claim 1, wherein a form and manner of the alert may be selected from several levels of alerts.

18. The system according to claim 1, wherein the monitoring of the power consumption from the DC supply is performed by means of sampling of current consumption.

19. The system according to claim 1, wherein raw data resulting from the monitoring of the DC supply is transferred out via wired or wireless interface for a purpose of processing or future analysis.