Systems, methods, and apparatus to enhance the integrity assessment when using power fingerprinting systems for computer-based systems

• US 9,886,583 B2
• Filed: 07/22/2016
• Issued: 02/06/2018
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: Power Fingerprinting Inc.
• Original Assignee: Power Fingerprinting Inc.
• Inventors: Aguayo Gonzalez, Carlos R., Reed, Jeffrey H., Chen, Steven C.
• Primary Examiner(s): PYZOCHA, MICHAEL J
• Application Number:
  US15/217,871
• Publication Number:
  US 20170140155A1
• Time in Patent Office: 564 Days
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/755 with measures against power attack
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system

Abstract

A power fingerprinting system is adopted for assessing integrity of a target computer-based system. In one implementation, the power fingerprinting system may receive, at a first module, side-channel information of a first target component of a system, the first module being collocated with the first target component; obtain a power fingerprint for the first target component based on the side-channel information for the first target component, the power fingerprint for the first target component representing a plurality of execution statuses of the first target component; receive, at a second module, side-channel information of a second target component of the system, the second module being collocated with the second target component, the power fingerprint for the second target component representing a plurality of execution statuses of the second target component; and obtain a power fingerprint for the second target component based on the side-channel information for the second target component.

Claims

1. An apparatus, comprising:

a power fingerprint monitor configured to receive a signal representing an unauthorized access of a device, the signal associated with bit transitions of an execution of a sequence of instructions by the device; and

a processor operatively coupled to the power fingerprint monitor, the processor configured to select a response from a plurality of responses in response to a detection of the unauthorized access based on the signal, the plurality of responses including at least one of a first response, a second response, and a third response; and

the processor configured to collect information associated with the device during the unauthorized access in response to the first response being selected,

the processor configured to prevent access to the device in response to the unauthorized access in response to the second response being selected,

the processor configured to disable at least a portion of the device subjected to the unauthorized access in response to the third response being selected.

2. The apparatus of claim 1, wherein the processor is configured to send a report signal based on information associated with the device during the unauthorized access.

3. The apparatus of claim 1, wherein:

the plurality of responses includes a fourth response,

the device is a first device, and

the processor is configured to collect information associated with at least one of the unauthorized access or a second device that triggered the unauthorized access based on the fourth response from the plurality of responses.

4. The apparatus of claim 1, wherein the processor is configured to temporarily disable the portion of the device including at least one of powering down the device, resetting the device, or preventing operation of the portion of the device.

5. The apparatus of claim 1, wherein the processor is configured to permanently disable the portion of the device including at least one of (1) physically damaging the portion of the device, (2) destroying the portion of the device, (3) setting the portion of the device into an irrecoverable logic state, or (4) permanently erasing a memory of the device.

6. The apparatus of claim 1, wherein the power fingerprint monitor is configured to allocate additional processing resource to the device in response to the detection of the unauthorized access.

7. The apparatus of claim 1, wherein the processor is configured to be operatively coupled to a circuit, the circuit configured to provide a power spike to physically damage the portion of the device in response to the third response being selected.

8. The apparatus of claim 1, wherein the power fingerprint monitor is configured to receive the signal from a sensor, the sensor configured to capture side-channel information of the device.

9. The apparatus of claim 1, wherein the power fingerprint monitor is configured to receive the signal from a sensor, the signal associated with a power signature of the device in response to the unauthorized access.

10. A method, comprising:

receiving, from a sensor, power signature information of a target device, the power signature information associated with bit transitions of an execution of a sequence of instructions during an anomaly behavior of the target device;

determining, based on the power signature information and in response to the anomaly behavior, a response from a plurality of responses that includes collecting information associated with the target device during the anomaly behavior; and

sending, after the determining, a signal to execute the response.

11. The method of claim 10, wherein:

the response is a first response, and

the plurality of responses includes a second response that prevents subsequent access to the target device in response to the anomaly behavior.

12. The method of claim 10, wherein:

the response is a first response, and

the plurality of responses includes a second response that disables at least a portion of the target device in response to the anomaly behavior.

13. The method of claim 10, wherein:

the response is a first response, and

the plurality of responses includes a second response that sends a report signal based on the power signature information of the target device during the anomaly behavior.

14. The method of claim 10, wherein:

the response is a first response, and

the plurality of responses includes a second response that collects information associated with at least one of the anomaly behavior or a device that triggered the anomaly behavior.

15. The method of claim 10, wherein:

the response is a first response, and

the plurality of responses includes a second response that temporarily disables a portion of the target device including at least one powering down the target device, resetting the target device, or preventing operation of the portion of the target device.

16. The method of claim 10, wherein:

the response is a first response, and

the plurality of responses includes a second response that permanently disables a portion of the target device including at least one of (1) physically damaging the portion of the target device, (2) destroying the portion of the target device, (3) setting the portion of the target device into an irrecoverable logic state, or (4) permanently erasing a memory of the target device.

17. The method of claim 10, wherein:

the target device has a first allocation of processing resources prior to the sending,

the sending includes sending the signal such that the target device receives a second allocation of the processing resources that is greater than the first allocation of the processing resources.

18. The method of claim 10, wherein:

the response is a first response, and

the plurality of responses includes a second response that sends a power spike to physically damage a portion of the target device.

19. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:

receive, from a sensor, power signature information of a target device during an unauthorized access to the target device;

determine, based on the power signature information and in response to a detection of the unauthorized access, a response from a plurality of responses that includes collecting information associated with the target device during the unauthorized access; and

send a signal to execute the response.

20. The non-transitory processor-readable medium of claim 19, wherein:

the response is a first response, and

the plurality of responses includes a second response that prevents access to the target device in response to the unauthorized access.