The concept of Internet of Things (IoT) has become more popular in the modern era of technology than ever before From small household devices to large industrial machines, the vision of IoT has made it possible to connect the devices with the physical world around them This increasing popularity has also made the IoT devices and applications in the center of attention among attackers Already, several types of malicious activities exist that attempt to compromise the security and privacy of the IoT devices One interesting emerging threat vector is the attacks that abuse the use of sensors on IoT devices IoT devices are vulnerable to sensor-based threats due to the lack of proper security measurements available to control use of sensors by apps By exploiting the sensors (eg, accelerometer, gyroscope, microphone, light sensor, etc) on an IoT device, attackers can extract information from the device, transfer malware to a device, or trigger a malicious activity to compromise the device In this survey, we explore various threats targeting IoT devices and discuss how their sensors can be abused for malicious purposes Specifically, we present a detailed survey about existing sensor-based threats to IoT devices and countermeasures that are developed specifically to secure the sensors of IoT devices Furthermore, we discuss security and privacy issues of IoT devices in the context of sensor-based threats and conclude with future research directions

A Survey on Sensor-based Threats to Internet-of-Things (IoT) Devices and Applications

Modern electronic devices have become “smart” as well as omnipresent in our day-to-day lives. From small household devices to large industrial machines, smart devices have become very popular in every possible application domain. Smart devices in our homes, offices, buildings, and cities can connect with other devices as well as with the physical world around them. This increasing popularity has also placed smart devices as the center of attention among attackers. Already, several types of malicious activities exist that attempt to compromise the security and privacy of smart devices. One interesting and noteworthy emerging threat vector is the attacks that abuse the use of sensors on smart devices. Smart devices are vulnerable to sensor-based threats and attacks due to the lack of proper security mechanisms available to control the use of sensors by installed apps. By exploiting the sensors (e.g., accelerometer, gyroscope, microphone, light sensor, etc.) on a smart device, attackers can extract information from the device, transfer malware to a device, or trigger a malicious activity to compromise the device. In this paper, we explore various threats and attacks abusing sensors of smart devices for malicious purposes. Specifically, we present a detailed survey about existing sensor-based threats and attacks to smart devices and countermeasures that have been developed to secure smart devices from sensor-based threats. Furthermore, we discuss security and privacy issues of smart devices in the context of sensor-based threats and attacks and conclude with future research directions.

A Survey on Sensor-Based Threats and Attacks to Smart Devices and Applications

Embedded cryptographic systems, such as smart cards, require secure implementations that are robust to a variety of low-level attacks. Side-Channel Attacks (SCA) exploit the information such as power consumption, electromagnetic radiation and acoustic leaking through the device to uncover the secret information. Attackers can mount successful attacks with very modest resources in a short time period. Therefore, many methods have been proposed to increase the security against SCA. Randomizing the execution order of the instructions that are independent, i.e., random shuffling, is one of the most popular among them. Implementing instruction shuffling in software is either implementation specific or has a significant performance or code size overhead. To overcome these problems, we propose in this work a generic custom hardware unit to implement random instruction shuffling as an extension to existing processors. The unit operates between the CPU and the instruction cache (or memory, if no cache exists), without any modification to these components. Both true and pseudo random number generators are used to dynamically and locally provide the shuffling sequence. The unit is mainly designed for in-order processors, since the embedded devices subject to these kind of attacks use simple in-order processors. More advanced processors (e.g., superscalar, VLIW or EPIC processors) are already more resistant to these attacks because of their built-in ILP and wide word size. Our experiments on two different soft in-order processor cores, i.e., OpenRISC and MicroBlaze, implemented on FPGA show that the proposed unit could increase the security drastically with very modest resource overhead. With around 2p area, 1.5p power and no performance overhead, the shuffler increases the effort to mount a successful power analysis attack on AES software implementation over 360 times.

https://dl.acm.org/doi/pdf/10.1145/2086696.2086699

An architecture-independent instruction shuffler to protect against side-channel attacks

Cryptographic systems are being compromised by power analysis attacks. In this paper, a novel countermeasure technique against power analysis attacks is proposed which dynamically varies the clock when executing operations (making it difficult to correlate power traces in the time domain) and inserts dummy operations during idling clock cycles (reducing the signal-to-noise ratio of the useful information). Its effectiveness is shown by performing a DPA attack on basic, intermediate (random clock) and advanced (random clock and dummy data) designs for the AES encryption algorithm, implemented on a FPGA-based board. The intermediate design is resistant to classical DPA attacks and the advanced design reduces the SNR by 79% (increasing area by 70% and reducing performance by 5.33%) when compared to the basic design. It is shown that the design is better in both metrics than other countermeasure techniques.

Random clock against differential power analysis

This paper introduces a generic and automated methodology to protect hardware designs from side-channel attacks in a manner that is fully compatible with commercial standard cell design flows. The paper describes a tool that artificially adds jitter to the clocks of the sequential elements of a cryptographic unit, which increases the non-determinism of signal timing, thereby making the physical device more difficult to attack. Timing constraints are then specified to commercial EDA tools, which restore the circuit functionality and efficiency while preserving the introduced randomness. The protection scheme is applied to an AES-128 hardware implementation that is synthesized using both ASIC and FPGA design flows.

An EDA-friendly protection scheme against side-channel attacks

For FPGA-centric implementations a countermeasure enhancing immunity against differential power analysis (DPA) attacks is proposed, that introduces pseudorandom clocking scheme to Advanced Encryption Standard (AES) cipher based multi-clock system with embedded single inverter ring oscillators (SIROs).

Random clocking induced DPA attack immunity in FPGAs

Side channel attacks (SCAs) are very effective in extracting information from algorithmically secure systems. Since, the earliest reports of attacks exploiting side channels such as power consumption, timing behavior and electromagnetic radiation etc., the countermeasures to resist such attacks have also been proposed. FPGAs originally thought to be resistant to such attacks because of some inherent characteristics were also found to leak information over the side channels. Overtime, SCA countermeasures have been proposed that continue to fade away as resistant attack techniques are developed. In this article an FPGA implementation of a multi-clock system with cipher embodiment, incorporating a novel countermeasure to resist SCAs, is presented. The proposed methodology of embedding single inverter ring oscillators (SIROs) within the synchronous cores helps improve immunity against electromagnetic, fault and glitch attacks, while the introduction of frequency hopping by randomly varying frequency driving the cipher hardens the system against power and timing attacks. The incorporated countermeasure enhances the immunity of FPGA based implementation against multiple types of SCAs without adversely affecting cost or performance.

A Novel Countermeasure Enhancing Side Channel Immunity in FPGAs

Balsa developed by Advanced Processor Technology(APT) Group of Manchester University presents robust design environment that supports both a framework for synthesizing asynchronous hardware systems and the language for describing such systems. In this paper, a design of microprocessor, MSP430, in balsa language and the functional verification of the controller is presented. Back-end retargeting is performed as a part of the design methodology in Balsa. By back-end retargeting procedure, a new technology library including FPGA cell library is incorporated into Balsa design environment. Moreover, the circuit area is analyzed and reduced in different implementation styles by replacing helpercells in balsa into standard cells of the target library.

Design of asynchronous MSP430 microprocessor using balsa back-end retargeting

A power-on reset circuit according to an embodiment of the present invention includes an input control unit configured to generate a default input signal in response to a power-on reset signal and a clock, a counting unit configured to perform a counting operation in response to the default input signal to generate a count offset signal, and a power-on reset unit configured to perform a counting operation in response to the count offset signal to generate the power-on reset signal.

Yousaf Zafar

Papers

Random clocking induced DPA attack immunity in FPGAs

A Novel Countermeasure Enhancing Side Channel Immunity in FPGAs

Design of asynchronous MSP430 microprocessor using balsa back-end retargeting

Power-on reset circuit