[论文解读] Attack Resilience and Recovery using Physical Challenge Response Authentication for Active Sensors Under Integrity Attacks

Yasser Shoukry, Paul Martin+3 more|arXiv (Cornell University)|May 6, 2016

Physical Unclonable Functions (PUFs) and Hardware Security被引用 7

一句话总结

本文提出 PyCRA，一种物理挑战-响应认证方案，通过使用随机化物理信号探测环境，并依据物理定律验证响应，从而增强主动传感器的安全性。通过利用物理动力学的不变性，PyCRA 在模拟域中检测并抵御完整性攻击，理论与实证验证表明其在欺骗与混淆阶段均具备抗性，适用于磁传感器和 RFID 标签。

ABSTRACT

Embedded sensing systems are pervasively used in life- and security-critical systems such as those found in airplanes, automobiles, and healthcare. Traditional security mechanisms for these sensors focus on data encryption and other post-processing techniques, but the sensors themselves often remain vulnerable to attacks in the physical/analog domain. If an adversary manipulates a physical/analog signal prior to digitization, no amount of digital security mechanisms after the fact can help. Fortunately, nature imposes fundamental constraints on how these analog signals can behave. This work presents PyCRA, a physical challenge-response authentication scheme designed to protect active sensing systems against physical attacks occurring in the analog domain. PyCRA provides security for active sensors by continually challenging the surrounding environment via random but deliberate physical probes. By analyzing the responses to these probes, and by using the fact that the adversary cannot change the underlying laws of physics, we provide an authentication mechanism that not only detects malicious attacks but provides resilience against them. We demonstrate the effectiveness of PyCRA through several case studies using two sensing systems: (1) magnetic sensors like those found wheel speed sensors in robotics and automotive, and (2) commercial RFID tags used in many security-critical applications. Finally, we outline methods and theoretical proofs for further enhancing the resilience of PyCRA to active attacks by means of a confusion phase---a period of low signal to noise ratio that makes it more difficult for an attacker to correctly identify and respond to PyCRA's physical challenges. In doing so, we evaluate both the robustness and the limitations of PyCRA, concluding by outlining practical considerations as well as further applications for the proposed authentication mechanism.

研究动机与目标

• 解决嵌入式传感器易受物理层完整性攻击的漏洞，此类攻击可绕过数字安全机制。
• 开发一种运行时认证机制，于模拟信号层面运行，以在信号数字化前检测欺骗与篡改行为。
• 利用控制传感器响应的物理定律，构建一种对篡改天然具有抗性的信任模型。
• 在真实世界的主动传感系统（包括磁传感器和 RFID 标签）上，验证该方法的可行性与鲁棒性。
• 引入混淆阶段，通过在挑战-响应周期中降低信噪比，进一步增强系统对主动攻击者的防护能力。

提出的方法

• 使用主动传感器向环境发射随机化的物理探测信号（例如电磁或机械信号）。
• 测量环境对这些探测信号的物理响应，依赖于自然物理定律对可能响应的约束。
• 通过验证响应在给定挑战下是否符合预期的物理行为，来认证传感器的输出。
• 应用混淆阶段——有意降低信噪比——以阻碍攻击者预测或模拟正确响应。
• 采用概率框架建模系统，其中在攻击下正确响应对齐的概率受 α 限制，确保渐近检测可靠性。
• 使用随机过程与似然函数形式化检测与恢复机制，量化攻击检测概率与误报率。

实验结果

研究问题

• RQ1 能否将物理定律用作物理域传感器数据认证的可信锚点？
• RQ2 如何利用主动传感技术检测绕过传统数字安全机制的完整性攻击？
• RQ3 受控的混淆阶段对攻击者伪造物理挑战-响应系统中正确响应能力的影响如何？
• RQ4 PyCRA 在真实世界主动传感器（如磁传感器和 RFID 标签）上，能在多大程度上检测并恢复欺骗攻击？
• RQ5 在对抗性条件下，PyCRA 的检测概率与误报率可建立何种理论边界？

主要发现

• PyCRA 通过验证挑战与响应之间物理一致性，成功检测到主动传感器上的完整性攻击，即使攻击者控制了模拟信号路径亦成立。
• 系统实现攻击检测的渐近检测概率为 α，其中 Pr(τ = Γ + 1) ≈ α，τ 为检测时间，Γ 为攻击开始时间。
• 混淆阶段显著降低攻击者预测或模拟正确响应的能力，从而提高有效攻击成本。
• 实证评估表明，PyCRA 在真实条件下对磁传感器和商用 RFID 标签的欺骗攻击具有良好的检测效果。
• 理论分析证实，该检测机制在不同信噪比和对抗性探测策略下均具备鲁棒性。
• 只要响应未违反物理定律，即使攻击者完全控制模拟信号路径，该方法仍能保持高度抗性。