Software Integrity Research Articles

Remote Attestation via Self-Measurement

Remote attestation (RA) is a popular means of detecting malware in embedded and IoT devices. RA is usually realized as an interactive protocol, whereby a trusted party ( verifier ) measures software integrity of a potentially compromised remote device ( prover) . Early work focused on purely software-based and fully hardware-based techniques, neither of which is ideal for low-end embedded devices. More recent results yielded hybrid (SW/HW) architectures with a minimal set of features to support efficient and secure RA on low-end devices. All prior techniques require on-demand operation , i.e., RA is performed in real time . We identify some drawbacks of this general approach in the context of unattended devices: First, it fails to detect mobile malware that enters and leaves prover between successive RA instances. Second, it requires prover to engage in a potentially expensive (in terms of time and energy) computation, which can be harmful for mission-critical or real-time devices. To address these drawbacks, we introduce the concept of self-measurement , whereby prover periodically and securely measures and records its own software state, based on a pre-established schedule. A (possibly untrusted) verifier occasionally collects and verifies these measurements. We present the design of a concrete technique, called Efficient Remote Attestation via Self-Measurement for Unattended Settings, (ERASMUS), justify its features and evaluate its performance. In the process, we also define a new metric, Quality of Attestation (QoA). We believe that ERASMUS is well suited for time-sensitive and/or safety-critical applications that are not served well by on-demand RA. Finally, we show that ERASMUS is a promising stepping stone toward handling attestation of multiple devices (i.e., a group or swarm) with high mobility.

Lightweight instruction-level encryption for embedded processors using stream ciphers

Over the last 30 years, a number of secure processor architectures have been proposed to protect software integrity and confidentiality during its distribution and execution. In such architectures, encryption (together with integrity checking) is used extensively, on any data leaving a defined secure boundary.In this paper, we show how encryption can be achieved at the instruction level using a stream cipher. Thus encryption is more lightweight and efficient, and is maintained deeper in the memory hierarchy than the natural off-chip boundaries considered in most research works. It requires the control flow graph to be used and modified as part of the off-line encryption process, but thanks to the LLVM framework, it can be integrated easily in a compiler pipeline, and be completely transparent to the programmer.We also describe hardware modifications needed to support this encryption method, the latter were added to a 32-bit MIPS soft core. The synthesis performed on a Altera Cyclone V FPGA shows that encryption requires 26% of extra logic, while slowing-down execution time by an average of 48% in the best setting.

Revisiting the relationship between safety and security

Free to read on publisher website Safety and Security (S&S) have the same goal, that is to maintain the integrity of human, infrastructure, hardware, software, capital and intangible assets of a system. However, literature and practice indicate that the relationship between S&S has not yet been clearly defined and their boundaries remain blurry. The current paper presents a short review of academic and professional literature about the relationship between S&S. This relationship is examined by looking at the S&S dependencies, their similarities and differences, and the role of the human element in achieving and maintaining the desired S&S levels. The review of literature showed that (1) there is a tendency to emphasize on the effects of security on safety and underestimate the opposite, (2) human factors are not part of security training to the extent are addressed in safety training, (3) security and safety problems can be the result of both internal and external disturbances and agents, (4) the intentionality or not of outcomes, and not of the action, can stand as a valid criterion to classify an event as a security or a safety one correspondingly, (5) S&S issues can result in negative implications internally and externally to the system, and (6) the synergy between S&S is of paramount importance for achieving the optimum levels of system protection. The positions of this paper might comprise a basis for enriching educational programmes around S&S and igniting relevant research.

Safety critical software ground rules

Safety critical software development field is one of the active research areas in many industries like automotive, medical, railways, nuclear and aerospace are placing increased value on safety and reliability. Safety critical software systems are those systems whose failure could result in the death or a serious injury to the people’s life, security is one of the important topics in the field of safety-critical systems and it must be addressed completely in order to operate safety critical software successfully. In this paper we present a study about the set of standards and different ground rules to be followed in critical software development practices in different industries and the challenges in applying these standards. We also discuss the role of static analysis and software integrity levels in these standards, similarities in these standards and the set of activities followed in the development process of these standards.

Realization of the mechanism of control software integrity in post quantum period

This article is devoted to description the realization of the public-key infrastructure using the stateless algorithm of digital signature with quantum-resistance. This article is detail describe the development cycle and implementation of the stateless signature scheme using the hash function of DSTU 7564:2014.

Fault Attacks on Secure Embedded Software: Threats, Design, and Evaluation

Embedded software is developed under the assumption that hardware execution is always correct. Fault attacks break and exploit that assumption. Through the careful introduction of targeted faults, an adversary modifies the control-flow or data-flow integrity of software. The modified program execution is then analyzed and used as a source of information leakage, or as a mechanism for privilege escalation. Due to the increasing complexity of modern embedded systems, and due to the difficulty of guaranteeing correct hardware execution even under a weak adversary, fault attacks are a growing threat. For example, the assumption that an adversary has to be close to the physical execution of software, in order to inject an exploitable fault into hardware, has repeatedly been shown to be incorrect. This article is a review on hardware-based fault attacks on software, with emphasis on the context of embedded systems. We present a detailed discussion of the anatomy of a fault attack, and we make a review of fault attack evaluation techniques. The paper emphasizes the perspective from the attacker, rather than the perspective of countermeasure development. However, we emphasize that improvements to countermeasures often build on insight into the attacks.

AAoT: Lightweight attestation and authentication of low-resource things in IoT and CPS

With the rise of Internet of Things (IoT) and Cyber-Physical Systems (CPS), the need for smart embedded devices is rapidly increasing, and so does the security and privacy risk. This paper focuses on enabling both remote attestation and authentication of current commodity low-resource embedded devices to enhance security in the IoT and CPS contexts. We demonstrate a detailed design and prototype implementation of AAoT, a lightweight and practical mechanism for Attestation and Authentication of Things, that can provide software integrity, mutual authentication and tamper-proof feature for smart embedded devices. AAoT is based on physical unclonable functions (PUFs), random memory filling and software attestation without requiring any changes in existing micro-controller units (MCUs). We show how to obtain efficient implementations and optimizations for each of the building blocks of AAoT, including a PUF-based memory filling, a checksum function with block-based traversal, a pseudorandom function, a reverse fuzzy extractor and a random number generator. The prototype is implemented on a low-end MCU platform (TI MSP430) by using onboard SRAM, registers and Flash resources.

Development of the ECAT Preprocessor with the Trust Communication Approach

In the past several years, attacks over industrial control systems (ICS) have become increasingly frequent and sophisticated. The most common objectives of these types of attacks are controlling/monitoring the physical process, manipulating programmable controllers, or affecting the integrity of software and networking equipment. As one of the widely applied protocols in the ICS world, EtherCAT is an Ethernet-based protocol; thus, it is exposed to both TCP/IP and ICS-specific attacks. In this paper, we analyze EtherCAT field-level communication principles from the security viewpoint focusing on the protocol vulnerabilities, which have been rarely analyzed previously. Our research showed that it lacks the most common security parameters, such as authentication, encryption, and authorization, and is open to Media Access Control (MAC) spoofing, data injection, and other advanced attacks, which require superior skills. To prevent, detect, and reduce attacks over the EtherCAT-based critical systems, first, we improved the open-source Snort intrusion detection/prevention system (IDS/IPS) to support packets that are not processed over transport and network layers. Second, by incorporating a vulnerability analysis, we proposed the EtherCAT (ECAT) preprocessor. Third, we introduced a novel approach called trust-node identification and applied the approach as three rules into the preprocessor. In this sense, the ECAT preprocessor differs from other supported ICS preprocessors in the literature, such as DNP3 and Modbus/TCP. Besides supporting traditional rule expansion, it is also able to handle layer 2 packets and to apply deep packet inspection on EtherCAT packets using the trust-node approach. This method first identifies engineering-station approved nodes based on EtherCAT network information (ENI) configuration files and then deeply inspects incoming packets, considering protocol specifications. The improvements and approach have been tested on the physically developed testbed environment and we have proved that proposals can detect related attacks and provide a basic level of security over the EtherCAT-implemented systems.

Dynamic Swarm Attestation With Malicious Devices Identification

Nowadays, there is a rapid development of smart sensor network solutions. To prevent potential malicious attacks and make sure that the activities of devices are correct, there is a pressing need to ensure the software integrity of devices in the large-scale, dynamic, and self-organization swarm. Different from those single device attestation studies, Asokan et al. are the first to consider the secure swarm attestation problem and provide implementations based on two remote attestation architectures for embedded systems. However, their scheme could not provide a correct attestation result with dynamic swarm topology. Also, their scheme could not prevent a malicious device from launching a new attestation, and the adversary can use this weakness to conduct energy exhausting attack. In this paper, we mainly focus on secure and efficient identity attestation of compromised devices over swarm with dynamic topology and design an interactive swarm attestation scheme. Furthermore, we introduce multi-hop attestation security in swarm attestation and provide a verifiable solution for new attestation launching solution based on the one-way hash chain. Moreover, theoretical and practical analyses prove that our scheme is secure and efficient in attestation security and energy saving for dynamic swarm topology.

SOFIA: Software and control flow integrity architecture

Software components are frequently used in cyber-physical systems (CPSes) to control a physical mechanism, such as a valve or brakes on a car. These systems are extremely sensitive to software vulnerabilities, as their exploitation could lead to injury, damage to equipment, or environmental catastrophe. This paper proposes a hardware-based security architecture called SOFIA, which protects software running on microprocessors used in CPSes. SOFIA provides mechanisms to protect software integrity and control flow integrity. This allows the processor to defend against a large number of attacks, including code injection, code reuse, and fault-based attacks on the program counter. In addition, the architecture also defends against software copyright infringement and reverse engineering. All protection mechanisms are enforced in hardware using cryptographic techniques. We are the first to propose a mechanism to enforce control flow integrity at the finest possible granularity using cryptographic techniques. A SOFIA core has been created by implementing the proposed architectural features on a LEON3 microprocessor. The SOFIA core requires that its software conforms to a strict format. To this end, we additionally designed and implemented a software toolchain to compile source code that adheres to the formatting rules. Several benchmarks were compiled with the SOFIA toolchain, and were executed on a SOFIA core running on an FPGA, showing an average total execution time overhead of 106% compared to an unmodified LEON3 core. Our hardware evaluation shows a clock speed reduction of 23.2%.

Virtualization of the Encryption Card for Trust Access in Cloud Computing

The increasing use of virtualization puts stringent security requirements on software integrity and workload isolation of cloud computing. The encryption card provides hardware cryptographic services for users and is believed to be superior to software cryptography. However, we cannot use the encryption card directly in the user domain because of the complicated virtualization mechanisms and the security problems about the user key and the user private data flow. To address these challenges, we propose a new virtualization architecture to ensure the trustworthiness of encryption cards. First, we design a privacy preserving model to ensure the security of the dynamic schedule of encryption cards. Second, we present a hardware trust verification procedure based on the trusted platform module to supply a trusted virtualization hardware foundation. Third, we provide a series of security protocols to establish a trusted chain between users and encryption cards. Finally, we give security proofs of the encryption card virtualization architecture. Based on our prototype implementation, the encryption service provided by the encryption card has higher-level security and higher efficiency than software encryption. It provides strong support for security services of virtualization systems in cloud computing.

Ensuring Software Integrity in IoT Devices

This paper will review the available literature covering topics relevant to ensuring software integrity of the boot image and running code in networked devices. The paper will focus on hardware devices defined as IoT (Internet of Things) in the consumer space. Software-only (virtual) devices will also be discussed. Topics reviewed will include trusted anchor concepts and technologies, chain of trust and validation of code integrity, as well as the technologies which support them, such as PKI (public key infrastructure), secure storage and mutable and immutable identities.

SOFTWARE AND SYSTEM INTEGRITY ASSESSMENT

ABSTRACTThis article describes how the digital aspects of all critical infrastructures can evolve faster and be less vulnerable to cyber actions. Although focused on the US infrastructures it is applicable to all infrastructures world‐wide. The purpose is to motivate systems practitioners to become adept at software and system integrity assessment. We introduce the theory and method for discovering all logic, arithmetic, and semantic faults throughout an arbitrarily large, heterogeneous software suite. One version was initiated in the 1990's, proved effective in the marketplace but, being mostly manual, would not scale. Recently the principals of OntoPilot LLC http://www.ontopilot.com have devised a significantly different way to assess system integrity that is amenable to automation. The balance of this article introduces the situation, highlights the system principles involved, considers the challenges in assessing software integrity, highlights the opportunity and value proposition, outlines the automation technology and finishes with a call to action. We recommend that certification in system integrity assessment be considered as a facet of the professional certifications offered by INCOSE, NDIA, IISE, and other professional and industry associations.

Data access control method for multimedia content data sharing and security based on XMDR-DAI in mobile cloud storage

Mobile cloud storage service is used for users’ multimedia content data sharing or synchronization in effective way with several mobile devices. To save various content data in the mobile cloud storage, the matters of security should be treated in the process of data sharing to provide flexibility and expandability for solving its heterogeneousness. Currently, the cloud storage service generally encrypts the content data for the security. However, this method is not perfectly safe for it manages ID, password, and encryption key simply with software; thus it may accept unauthorized users. This research suggests the data access control model and the method for multimedia content sharing and security based on XMDR-DAI in the mobile cloud storage. It supports key management based on hardware, identification for the integrity of client software, and security key sharing. Also, the suggested model saves/manages different types of multimedia content, thus it establishes XMDR-DAI-based metadata relationship for the problems that occurred in searching to increase the reliability. And this research suggests the prototype using TPM emulator that is operated in secure world of ARM TrustZone and TrustZone environment.

Attestation in Wireless Sensor Networks

Attestation is a mechanism used by a trusted entity to validate the software integrity of an untrusted platform. Over the past few years, several attestation techniques have been proposed. While they all use variants of a challenge-response protocol, they make different assumptions about what an attacker can and cannot do. Thus, they propose intrinsically divergent validation approaches. We survey in this article the different approaches to attestation, focusing in particular on those aimed at Wireless Sensor Networks. We discuss the motivations, challenges, assumptions, and attacks of each approach. We then organise them into a taxonomy and discuss the state of the art, carefully analysing the advantages and disadvantages of each proposal. We also point towards the open research problems and give directions on how to address them.

Measurement-device-independent quantum digital signatures

Digital signatures play an important role in software distribution, modern communication and financial transactions, where it is important to detect forgery and tampering. Signatures are a cryptographic technique for validating the authenticity and integrity of messages, software, or digital documents. The security of currently used classical schemes relies on computational assumptions. Quantum digital signatures (QDS), on the other hand, provide information-theoretic security based on the laws of quantum physics. Recent work on QDS shows that such schemes do not require trusted quantum channels and are unconditionally secure against general coherent attacks. However, in practical QDS, just as in quantum key distribution (QKD), the detectors can be subjected to side-channel attacks, which can make the actual implementations insecure. Motivated by the idea of measurement-device-independent quantum key distribution (MDI-QKD), we present a measurement-device-independent QDS (MDI-QDS) scheme, which is secure against all detector side-channel attacks. Based on the rapid development of practical MDI-QKD, our MDI-QDS protocol could also be experimentally implemented, since it requires a similar experimental setup.

Identifying Effective Factors on Using Service Oriented Achitecture in E-Banking

One of the common problems of most banks in information technology in banking area is the lack of software integrity and data banks. For integrating goals, various methods and technologies have been developed. Service oriented architecture (SOA) is among the state of art technologies. The most important goal of employing SOA in e-banking includes enhancing the re-usage level and flexibility of information services, flexibility of information technology in response to continuous business changes, standardization and integration of systems and IT infrastructures. In spite of this, unluckily, most banks experience failure in employing this technology. According to the recent surveys, one of the bank’s failure reasons, is the lack of a comprehensive framework which comprises all effective factors of this architecture. Thus, the goal of this paper is to detect and analyze the effective factors on service oriented architecture in e-banking and providing a comprehensive framework which encompass all factors. This conceptual framework is essential for banks in implementing SOA properly in e-banking area. In this research, first, in this research effective factors of using SOA was detected by a case study, then most repeated factors were classified. By using statistical software, e.g. SPSS, Excel, statistical tests, e.g. validity and reliability tests and descriptive statistical tests were conducted and the most important factors were detected and a prioritized. As a result of this prioritization, the integration factor of systems had the most and organization features had the least significant effect on using SOA in e-banking.

Data and performances evaluation of the SPIDIA-DNA Pan-European External Quality Assessment: 2nd SPIDIA-DNA laboratory report.

Within the EU-SPIDIA project (www.spidia.eu), the quality parameters of blood genomic DNA were defined [SPIDIA-DNA: an External Quality Assessment for the pre-analytical phase of blood samples used for DNA-based analyses – [1]; Influence of pre-analytical procedures on genomic DNA integrity in blood samples: the SPIDIA experience – [2]; Combining qualitative and quantitative imaging evaluation for the assessment of genomic DNA integrity: the SPIDIA experience – [3]. DNA quality parameters were used to evaluate the laboratory performance within an External Quality Assessment (EQA) [Second SPIDIA-DNA External Quality Assessment (EQA): Influence of pre-analytical phase of blood samples on genomic DNA quality – [4]. These parameters included DNA purity and yield by UV spectrophotometric measurements, the presence of PCR interferences by Kineret software and genomic DNA integrity analysis by Pulsed Field Gel Electrophoresis.Here we present the specific laboratory report of the 2nd SPIDIA-DNA EQA as an example of data and performances evaluation.

FlexiCast: Energy-Efficient Software Integrity Checks to Build Secure Industrial Wireless Active Sensor Networks

Industrial wireless sensor networks (IWSNs) are advancing to a form of active networks called industrial wireless active sensor networks (IWASNs) with reprogrammable sensor nodes, and thus require a method to check the integrity of software in sensor nodes. Regarding energy efficiency, however, previous methods did not take into account the scalability of IWASNs and thus performed inefficiently. In this paper, we propose FlexiCast, which presents a novel energy-efficient method to check the integrity of software objects. Sensor nodes can efficiently detect a modification in software objects sent by a base station or stored in neighboring nodes through authenticated fingerprints and network-wide attestation. Our analysis shows that FlexiCast can reduce energy consumption by 71% for both updating software objects and checking modifications regarding more critical attacks.

IoT 기기를 위한 경량의 소프트웨어 제어 변조 탐지 기법

Constrained IoT devices cannot achieve full coverage of software attestation even though the integrity of software is critical. The limited modification attacks on control flow of software aim at the shadow area uncovered in software attestation processes. In this paper, we propose a light-weight protection system that detects modification by injecting markers to program code.