[论文解读] Injected and Delivered: Fabricating Implicit Control over Actuation Systems by Spoofing Inertial Sensors

Yazhou Tu, Zhiqiang Lin+2 more|arXiv (Cornell University)|Jun 20, 2018

Modular Robots and Swarm Intelligence被引用 47

一句话总结

本文分析非侵入式带外声学注入，以欺骗嵌入式 MEMS 惯性传感器并实现隐式控制，提出 Side-Swing 和 Switching 攻击并对 25 台设备进行评估。

ABSTRACT

Inertial sensors provide crucial feedback for control systems to determine motional status and make timely, automated decisions. Prior efforts tried to control the output of inertial sensors with acoustic signals. However, their approaches did not consider sample rate drifts in analog-to-digital converters as well as many other realistic factors. As a result, few attacks demonstrated effective control over inertial sensors embedded in real systems. This work studies the out-of-band signal injection methods to deliver adversarial control to embedded MEMS inertial sensors and evaluates consequent vulnerabilities exposed in control systems relying on them. Acoustic signals injected into inertial sensors are out-of-band analog signals. Consequently, slight sample rate drifts could be amplified and cause deviations in the frequency of digital signals. Such deviations result in fluctuating sensor output; nevertheless, we characterize two methods to control the output: digital amplitude adjusting and phase pacing. Based on our analysis, we devise non-invasive attacks to manipulate the sensor output as well as the derived inertial information to deceive control systems. We test 25 devices equipped with MEMS inertial sensors and find that 17 of them could be implicitly controlled by our attacks. Furthermore, we investigate the generalizability of our methods and show the possibility to manipulate the digital output through signals with relatively low frequencies in the sensing channel.

研究动机与目标

• 动机并评估对用于控制系统的 MEMS 惯性传感器的非侵入式欺骗攻击的风险。
• 描述带外声学信号如何与 ADC 采样交互以产生可控的数字输出。
• 开发两种攻击范式（Side-Swing 和 Switching）以在期望方向上偏置传感器读数。
• 在多样化的真实设备上评估攻击可行性并阐明影响因素（采样率漂移、幅度、相位）。

提出的方法

• 对带外模拟信号在欠采样与混叠条件下的数字化进行建模。
• 定义并分析采样率漂移如何放大数字化输出中的频率偏差（定理1）。
• 引入数字幅度调整以塑形振荡的数字信号（欠采样效应）。
• 通过频率变化实现相位节奏，以引入相位偏移和方向控制。
• 描述两种非侵入式攻击方法（Side-Swing 与 Switching），使读数朝向目标方向偏置。
• 给出带外信号注入模型，其中 V[i]=A[i]·sin(Φ[i])，且 Φ[i] 取决于 ε 和 F_S。

实验结果

研究问题

• RQ1 非侵入式声学注入是否能够在实际系统中可靠地控制嵌入式 MEMS 惯性传感器？
• RQ2 采样率漂移、欠采样和相位效应如何使数字传感器输出发生操控？
• RQ3 实际攻击策略（Side-Swing、Switching）及其在不同设备上的有效性？
• RQ4 此类欺骗攻击影响的系统与执行器的范围是什么？

主要发现

• 在对比的 25 台设备中，17 台可以被声学攻击隐式控制。
• 有 23 台设备受到声学信号影响，控制程度各异。
• 有 2 台设备由于声音强度不足而表现出极限有限的易感性；4 台设备易受 DoS 攻击影响；2 台设备未受影响。
• 在测试设置中，陀螺仪传感器比加速度计更易受到对手控制。
• Side-Swing 攻击通过不对称幅度调制在目标方向累积航向。
• Switching 攻击通过重复切换声学频率以诱发相位节奏，从而实现更大的航向增益。