Towards Side-Channel Secure Firmware Updates - A Minimalist Anomaly Detection Approach

Side-channel attacks represent a serious threat to the security of encrypted firmware updates: if the secret key is leaked, then the firmware is exposed and can be replaced by malicious code or be stolen. In this work, we show how simple anomaly detection measures can effectively increase the security of encrypted firmware updates at minimum cost. Our method is based on the simple observation that firmware payloads have a specific structure (machine code), which can be easily verified at runtime in order to react to side-channel attacks. This enables performing proactive measures to limit the number of measurements that can be taken when a side-channel attack is detected. We tested the viability of our approach through simulations and verified its effectiveness in practice on a TI MSP430 microcontroller using a software implementation of AES. Our approach represents a step forward towards increasing the security of firmware updates against side-channel attacks: it effectively increases the security of firmware updates, has only negligible overhead in terms of code size and runtime, requires no modification to the underlying cryptographic implementations, and can be used in conjunction with countermeasures such as masking and re-keying to further enhance the side-channel resistance of a device.

[1]  Stefan Tillich,et al.  Attacking State-of-the-Art Software Countermeasures-A Case Study for AES , 2008, CHES.

[2]  R. Rudell,et al.  Multiple-Valued Logic Minimization for PLA Synthesis , 1986 .

[3]  Stefan Rass,et al.  On Efficient Leakage-Resilient Pseudorandom Functions with Hard-to-Invert Leakages , 2014, LATINCRYPT.

[4]  François-Xavier Standaert,et al.  Adaptive Chosen-Message Side-Channel Attacks , 2010, ACNS.

[5]  Christian Steger,et al.  A side channel attack countermeasure using system-on-chip power profile scrambling , 2011, 2011 IEEE 17th International On-Line Testing Symposium.

[6]  Hsinchun Chen,et al.  Uninvited Connections: A Study of Vulnerable Devices on the Internet of Things (IoT) , 2014, 2014 IEEE Joint Intelligence and Security Informatics Conference.

[7]  Jovan Dj. Golic,et al.  Multiplicative Masking and Power Analysis of AES , 2002, CHES.

[8]  Benjamin Grégoire,et al.  Verified Proofs of Higher-Order Masking , 2015, EUROCRYPT.

[9]  Elena Trichina,et al.  Simplified Adaptive Multiplicative Masking for AES , 2002, CHES.

[10]  Stefan Mangard,et al.  One for all - all for one: unifying standard differential power analysis attacks , 2011, IET Inf. Secur..

[11]  VARUN CHANDOLA,et al.  Anomaly detection: A survey , 2009, CSUR.

[12]  Christof Paar,et al.  Black-Box Side-Channel Attacks Highlight the Importance of Countermeasures - An Analysis of the Xilinx Virtex-4 and Virtex-5 Bitstream Encryption Mechanism , 2012, CT-RSA.

[13]  Kevin Fu,et al.  Secure Software Updates: Disappointments and New Challenges , 2006, HotSec.

[14]  Stefan Mangard,et al.  Towards fresh re-keying with leakage-resilient PRFs: cipher design principles and analysis , 2014, Journal of Cryptographic Engineering.

[15]  Zhizhang Chen,et al.  Side channel power analysis of an AES-256 bootloader , 2015, 2015 IEEE 28th Canadian Conference on Electrical and Computer Engineering (CCECE).

[16]  Josep Balasch,et al.  On the Cost of Lazy Engineering for Masked Software Implementations , 2014, CARDIS.

[17]  Jean-Sébastien Coron,et al.  Resistance against Differential Power Analysis for Elliptic Curve Cryptosystems , 1999, CHES.

[18]  Antoine Joux,et al.  Towards Super-Exponential Side-Channel Security with Efficient Leakage-Resilient PRFs , 2012, CHES.

[19]  Stefan Mangard,et al.  Successfully Attacking Masked AES Hardware Implementations , 2005, CHES.

[20]  Dorothy E. Denning,et al.  An Intrusion-Detection Model , 1987, IEEE Transactions on Software Engineering.

[21]  Georg Sigl,et al.  Risk management in embedded devices using metering applications as example , 2014, WESS '14.

[22]  Amir Moradi,et al.  Lightweight Cryptography and DPA Countermeasures: A Survey , 2010, Financial Cryptography Workshops.