Using Power Fingerprinting (PFP) to Monitor the Integrity and Enhance Security of Computer Based Systems

• US 20130318607A1
• Filed: 11/03/2011
• Published: 11/28/2013
• Est. Priority Date: 11/03/2010
• Status: Active Grant

• Current Assignee: Virginia Tech Intellectual Properties, Inc.
• Original Assignee: Virginia Tech Intellectual Properties, Inc.
• Inventors: Reed, Jeffrey H., Aguayo Gonzalez, Carlos R.
• Granted Patent: US 9,262,632 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 1/28 Supervision thereof, e.g. detecting power-supply failure by out of limits supervision
• CPC Class Codes: G06F 1/3206 Monitoring of events, devices or parameters that trigger a change in power modality
• CPC Class Codes: G06F 11/3062 where the monitored property is the power consumption power management in a computing system G06F1/3203
• CPC Class Codes: G06F 11/3093 Configuration details thereof, e.g. installation, enabling, spatial arrangement of the probes
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/755 with measures against power attack
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Procedures are described for enhancing target system execution integrity determined by power fingerprinting (PFP): by integrating PFP into the detection phase of comprehensive defense-in-depth security; by deploying a network of PFP enabled nodes executing untrusted devices with predefined inputs forcing a specific state sequence and specific software execution; by embedding module identification information into synchronization signaling; by combining signals from different board elements; by using malware signatures to enhance PFP performance; by automatic characterization and signature extraction; by providing secure signature updates; by protecting against side-channel attacks; performing real-time integrity assessment in embedded platform by monitoring their dynamic power consumption and comparing it against signatures from trusted code, including pre-characterizing power consumption of the platform by concentrating on trace sections carrying the most information about the internal execution status; by using PFP from sequence of bit transitions to detect deviations from authorized execution of software in a digital processor.

Claims

1. A method for performing real-time integrity assessment of execution of a routine in a computer processing platform, comprising:

monitoring execution of the routine by tracing power consumption of a processor by sampling during execution of the routine;

using a platform characterization technique that further comprises

detecting sections of the traces that display the largest dependence on state transitions in the processor;

using said sections to select features carrying the most information;

obtaining from a characterization of selected features of the routine contained in said sections a set of trusted power fingerprints of the routine;

establishing a threshold for a specific false alarm rate based on the probability distribution of distance from a signature comprised of said trusted fingerprints;

comparing a library of said trusted fingerprints to features extracted from traces from the execution of untrusted code

determining a distance between said fingerprints and the extracted features; and

reporting an exception if the distance exceeds the threshold.

2. The method of claim 1 further comprising synchronizing said tracing with execution of the routine by embedding module identification information into the routine.

3. The method of claim 2 wherein the module identification information is a binary identification code written in an IO register before execution of the routine.

4. The method of claim 2 wherein the module identification information is a sequence of instructions yielding a distinctive power consumption pattern.

5. The method of claim 1 wherein the tracing of power consumption combines signals from a plurality of processor circuits.

6. The method of claim 1 further comprising enhancing the quality of said exception reporting by adding to said library fingerprint signatures of known malware.

7. A system for performing real-time integrity assessment of execution of a routine in a computer processing platform, comprising:

means for monitoring execution of the routine by tracing power consumption of a processor by sampling during execution of the routine;

means for using a platform characterization technique that further comprises

means for detecting sections of the traces that display the largest dependence on state transitions in the processor;

means for using said sections to select features carrying the most information;

means for obtaining from a characterization of the selected features contained in said sections a set of trusted power fingerprints of the routine;

means for establishing a threshold for a specific false alarm rate based on the probability distribution of distance from a signature comprised of said trusted fingerprints;

means for comparing a library of said trusted fingerprints to features extracted from traces from the execution of untrusted code

means for determining a distance between said fingerprints and the extracted features; and

means for reporting an exception if the distance exceeds the threshold.

8. The system of claim 7 further comprising module identification information embedded into the routine.

9. The system of claim 8 wherein the module identification information is a binary identification code written in an IO register before execution of the routine.

10. The system of claim 8 wherein the module identification information is a sequence of instructions yielding a distinctive power consumption pattern.

11. The system of claim 7 wherein the means for tracing of power consumption combines signals from a plurality of processor circuits.

12. The system of claim 7 further comprising means for enhancing the quality of said exception reporting by adding to said library fingerprint signatures of known malware.

13. A method for detecting deviations from authorized execution of software in a digital processor, comprising:

observing power consumption of the processor during execution of at least one routine of the software in a known setting;

determining a sequence of bit transitions characterizing the power consumption of said at least one routine; and

using the power consumption characterization as a fingerprint for comparison against observed execution of the software to determine deviation.