Using power fingerprinting (PFP) to monitor the integrity and enhance security of computer based systems

• US 10,423,207 B2
• Filed: 12/21/2016
• Issued: 09/24/2019
• Est. Priority Date: 11/03/2010
• Status: Active Grant

• Current Assignee: Virginia Tech Intellectual Properties, Inc.
• Original Assignee: Virginia Tech Intellectual Properties, Inc.
• Inventors: Reed, Jeffrey H., Aguayo Gonzalez, Carlos R.
• Primary Examiner(s): Brown, Anthony D
• Application Number:
  US15/386,433
• Publication Number:
  US 20170310482A1
• Time in Patent Office: 1,007 Days
• Field of Search: 726 22- 25
• CPC Class Codes: G06F 1/28 Supervision thereof, e.g. detecting power-supply failure by out of limits supervision
• CPC Class Codes: G06F 1/3206 Monitoring of events, devices or parameters that trigger a change in power modality
• CPC Class Codes: G06F 11/3062 where the monitored property is the power consumption power management in a computing system G06F1/3203
• CPC Class Codes: G06F 11/3093 Configuration details thereof, e.g. installation, enabling, spatial arrangement of the probes
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/755 with measures against power attack
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Procedures are described for enhancing target system execution integrity determined by power fingerprinting (PFP): by integrating PFP into the detection phase of comprehensive defense-in-depth security; by deploying a network of PFP enabled nodes executing untrusted devices with predefined inputs forcing a specific state sequence and specific software execution; by embedding module identification information into synchronization signaling; by combining signals from different board elements; by using malware signatures to enhance PFP performance; by automatic characterization and signature extraction; by providing secure signature updates; by protecting against side-channel attacks; performing real-time integrity assessment in embedded platform by monitoring their dynamic power consumption and comparing it against signatures from trusted code, including pre-characterizing power consumption of the platform by concentrating on trace sections carrying the most information about the internal execution status; by using PFP from sequence of bit transitions to detect deviations from authorized execution of software in a digital processor.

Claims

1. A method, comprising:

observing power consumption of a processor using a sensor during execution of a first routine of software that has a first layer and a second layer, the first routine associated with the first layer and not the second layer;

observing power consumption of the processor using a sensor during execution of a second routine of software, the second routine associated with the second layer and not the first layer;

using the power consumption characterization of the first routine as a first fingerprint for comparison against observed execution of the first routine of the software to determine a first deviation;

using the power consumption characterization of the second routine as a second fingerprint for comparison against observed execution of the second routine of the software to determine a second deviation;

triggering an incident response associated with an attack on the first routine when the first deviation is determined; and

triggering an incident response associated with an attack on the second routine when the second deviation is determined.

2. The method of claim 1, wherein:

the first routine is associated with one of a kernel, an operating system function or a core application,

the second routine is associate with a remaining one of the kernel, the operating system function or the core application.

3. The method of claim 1, wherein:

the processor executes software associated with a security function including at least one of a firewall, a sandbox, an access control function, an encryption function, a denial of service protection function, or a virtualization function,

the incident response associated with the attack on the first routine is triggered after the security function failed to detect the attack.

4. The method of claim 1, wherein:

the processor executes software associated with a security function including at least one of a firewall, a sandbox, an access control function, an encryption function, a denial of service protection function, or a virtualization function,

power consumption of the processor during execution of the security function is not performed.

5. The method of claim 1, wherein:

the processor is a first processor,

a second processor executes software associated with a security function including at least one of a firewall, a sandbox, an access control function, an encryption function, a denial of service protection function, or a virtualization function,

power consumption of the processor during execution of the security function is not performed.

6. The method of claim 1, wherein:

the processor is a first processor,

a second processor executes software associated with a security function including at least one of a firewall, a sandbox, an access control function, an encryption function, a denial of service protection function, or a virtualization function,

the method further comprising;

observing power consumption of the second processor using a sensor during execution of the software associated with the security function;

using the power consumption characterization of the software associated with the security function as a fingerprint for comparison against observed execution of the software associated with the security function to determine a third deviation; and

triggering an incident response associated with an attack on the software associated with the security function when the third deviation is determined.

7. The method of claim 1, wherein the first layer and the second layer define a hierarchy, the first layer being higher in the hierarchy than the second layer.

8. The method of claim 1, wherein:

the incident response associated with the attack on the first routine is triggered without determining the second deviation occurred.

9. The method of claim 1, wherein:

the incident response associated with the attack on the second routine is triggered after the attack on the first routing failed to be determined.

10. The method of claim 1, wherein the incident response associated with the attack on the first routine differs from the incident response associated with the attack on the second routine.

11. A method, comprising:

observing, using a sensor, a power consumption of each processor from a plurality of processors during operation of that processor, the plurality of processors being of a common make and a common model;

determining, for each processor from the plurality of processors, a sequence of bit transitions characterizing the power consumption for that processor;

modifying the power consumption for at least one processor from the plurality of processors to compensate for manufacturing-related differences among the plurality of processors to define a power consumption characterization for that at least one processor; and

using, for each processor from the plurality of processors, the power consumption characterization for that processor as a fingerprint for comparison against a reference power consumption characterization to determine a deviation for that processor.

12. The method of claim 11, wherein:

the plurality of processors is a first plurality of processors,

the reference power consumption characterization is determined for a second plurality of processors that is from a plurality of trusted sources and that is not included in the first plurality of processors, the second plurality of processors being of the common make and the common model.

13. The method of claim 11, wherein the modifying the power consumption for at least one processor from the plurality of processors includes using an adaptive filter having taps that are dynamically modified to match characteristics of power consumption traces of that at least one processor.

14. The method of claim 11, wherein the deviation for a processor from the plurality of processors is based on a partial activation of extra functionality or execution flow of that processor while observing the power consumption of that processor.

15. The method of claim 11, wherein:

the determining, for each processor from the plurality of processors, includes executing a predefined state sequence for that processor,

the sequence of bit transitions characterizing the power consumption for that processor being in response to executing the predefined state sequence for that processor.

16. The method of claim 11, wherein:

the determining, for each processor from the plurality of processors, includes executing, on that processor, a software module from a plurality of software modules for that processor,

the sequence of bit transitions characterizing the power consumption for that processor being in response to executing the software module.

17. The method of claim 11, wherein the reference power consumption characterization is determined using a processor that is from a trusted source and that is not included in the plurality of processors.

18. The method of claim 11, wherein:

the determining, for each processor from the plurality of processors, is performed using a plurality of input vectors,

the reference power consumption characterization is determined using the plurality of input vectors and a processor that is from a trusted source and that is not included in the plurality of processors.

19. The method of claim 11, wherein the reference power consumption characterization is determined using a computer-based simulation using a plurality of deterministic input vectors.

20. The method of claim 11, wherein the manufacturing-related differences among the plurality of processors is based on different manufacturers, different suppliers or different processor versions.