Refine
Document Type
- Doctoral thesis (13)
- Master thesis (2)
Has Fulltext
- yes (15)
Is part of the Bibliography
- no (15)
Year of publication
Keywords
- Drahtloses Sensorsystem (6)
- Drahtlose Sensornetze (3)
- Elliptic curve cryptography (3)
- Seitenkanalattacke (3)
- Countermeasures (2)
- ECC (2)
- Elliptische Kurve (2)
- Elliptische Kurven (2)
- Fehleranalyse (2)
- Hardware Implementierung (2)
Institute
Die zunehmende Digitalisierung unserer Gesellschaft erfordert fortwährenden Schutz von kritischen Informationen mittels kryptographischer Systeme. Algorithmisch sind diese Systeme kaum anzugreifen. Allerdings ermöglichen sogenannte Seitenkanalattacken die Extraktion von geheimen Daten. Eine Art Seitenkanalattacken mit großem Angriffspotential ist die lokalisierte elektromagnetische Analyse. Bei diesem Verfahren werden durch Messung und Analyse der elektromagnetischen Abstrahlung von Teilen der Schaltung Rückschlüsse auf interne Zustände getroffen und dadurch geheime Informationen wie private Schlüssel extrahiert. Der aktuelle Stand der Forschung im Bereich lokalisierter EMA zeigt sowohl erfolgreiche Angriffe als auch Gegenmaßnahmen auf. Jedoch werden in den veröffentlichten Arbeiten keine detaillierten Untersuchungen hinsichtlich der genauen Umsetzung des Layouts der FPGA Implementierungen untersucht, welches die Ursache für den lokalisierten Leakage bildet. Stattdessen werden die Ursachen auf der algorithmischen Ebene des verwendeten kryptographischen Verfahrens betrachtet und ebenfalls eine algorithmische Gegenmaßnahme vorgeschlagen.
In dieser Arbeit wird der Einfluss des Layouts von FPGA und ASIC Implementierungen auf lokalisierte EMA Angriffe untersucht. Dabei spielt insbesondere die Platzierung der Register eine wichtige Rolle. Die Untersuchungen in dieser Arbeit werden genutzt, um weiterführende Maßnahmen zum Schutz von kryptographischen Implementierungen planen zu können.
Die Untersuchungsergebnisse zeigen, dass sowohl das Design selbst als auch die Implementierung als FPGA oder ASIC einen großen Einfluss auf die Angreifbarkeit der Implementierung durch eine lokalisierte EMA haben. So kann die FPGA Implementierung des betrachteten ECC Designs ebenfalls für diese Art von Angriffen verwundbar sein. Aufgrund ihrer Implementierung ist dieser ECC-Beschleuniger insgesamt weniger anfällig als ein Vergleichsdesign aus dem Stand der Forschung. Dennoch konnten potentielle Schwachstellen identifiziert werden, welche die Grundlage für die Planung und Umsetzung von Gegenmaßnahmen darstellen. Bei einer FPGA Implementierung des ECC Beschleunigers ist hauptsächlich die Lage der Flip-Flops im Layout die Ursache für die Anfälligkeit. Dem kann durch eine gleichmäßige Verteilung der Register zusammen mit permanent aktiver Logik entgegengewirkt werden, da die EM Abstrahlung der Logik die der Register überdeckt. Im Gegensatz dazu konnte bei der ASIC Implementierung keine Aussage über den Einfluss von Platzierungsvarianten getroffen werden, da die Einflüsse nicht messbar waren. Allerdings konnte die Verdrahtung auf der obersten Metallschicht als Leakagequelle bestimmt werden. Als Gegenmaßnahme dazu wird vorgeschlagen, durch Constraints die Ausgangssignale von Registern eines kryptographischen Chips nicht bis in die oberste Schicht zu routen.
With the introduction of the Internet at the end of the last century the modern society was fundamentally changed. Computer systems became an element of nearly all parts of our daily live. Due to the interconnection of these systems local borders are mostly vanished, so that information is accessible and exchangeable anywhere and at anytime. But this increased connectivity causes that physical fences are no longer an adequate protection for computer systems. Whereas the security of commodity computer systems was improved continuously and similarly with their increased connectivity, deeply embedded systems were then and now mostly protected by physical fences. But the ubiquitous availability of embedded systems in personal and commercial environments makes these systems likewise accessible and moves them strongly into the focus of security investigations.
Deeply embedded systems are usually equipped with tiny scale micro controllers, which are limited in their available resources and do not feature secure mechanisms to isolate system resources. Hence, a single error in a local software component is not limited to the component itself, instead the complete system may be influenced. The lack of resource isolation makes tiny scale systems prone for accidental errors but in particular vulnerable for a broad variety of malicious software. For a safe and secure operation of computer systems it is strongly recommended that software components are isolated in such a manner that they have access only to those resources, which are assigned to them. Even though a substantial number of approaches in the context of embedded system’s safety were investigated during the last fifteen years, security was mostly neglected.
This thesis is focused on security aspects where malicious software wittingly tries to bypass available protection mechanisms. The thesis introduces a security platform for tiny scale systems that enforces an isolation of software components considering security aspects. Due to the limited resources of tiny scale systems the proposed solution is based on a co-design process that takes the static and predefined nature of deeply embedded systems into account and includes hardware, compile-time, and run-time partitions to reduce the number of additional run-time components, to avoid performance drawbacks, and to minimize the memory as well as the components footprint overhead. To prove the applicability of the presented platform it was applied and evaluated with two real applications. In addition, an investigation of technologies of commodity computer systems that are suitable to build secure systems is presented. The thesis analyzes their enforcement based on the features provided by the introduced security platform. The contributions of this thesis include an enforcement of a security isolation of system resources on tiny scale systems and enable the development of a broad variety of secure tiny scale system applications.
Wireless sensor networks (WSNs) are built of cheap, resource constraint devices, capable to collect process and communicate data. WSN applications depend on the data they collect. In other words, the applications require the data to be available, even if some WSN nodes fail. The challenge is that nodes are prone to fail and todays WSNs do not provide highly reliable data storage. Thus, the quality of the service provided by the system, regarding the data handling, is one of the most important factors. Data replication increases the availability of the data and thus, the robustness and quality of the data storage. But the existence of several copies of data items in the WSN induces the data consistency to become of high importance in order to ensure proper behavior of the application. This work investigates the feasibility of data consistency models used in distributed shared memory in WSNs to provide more powerful distributed systems with reliable data exchange. As a starting point WSNs and consistency approaches are introduced. Based on those basics, the mechanisms needed to allow for data consistency are discussed as a theoretical framework for the prototypical implementation of a data consistency providing middleware, which was implemented as part of this work. The middleware adapts the mechanisms known from original memory consistency approaches to be usable in the sensor network area and proposes own, low cost mechanisms, as well. The latter are at least partially based on the idea that within the shared memory of WSNs information is the major concern and that by that the replica update rates can be tailored to the application. In order to allow for ease of use of the middleware the replication schemes and consistency mechanisms can be defined by the application engineer as a policy. The latter is transformed and injected into the middleware code by a pre-compiler, so that the application engineer no longer needs to implement replication and consistency mechanisms herself. The most appropriate memory consistency models are implemented and evaluated using the framework proposed in this thesis.
This thesis deals with strategies for achieving high data throughput in wireless sensor networks that use a time division multiple access (TDMA) scheme to resolve medium access. The thesis uses a multi-sided approach that deals not only with the scheduling algorithm but also with the network layer and the interference model. The thesis proposes four solutions that significantly improve data throughput, fairness, and latency in the considered scenario.
The thesis starts with an overview of state-of-the-art medium access control (MAC) protocols, emphasizing TDMA. Based on this overview, it is concluded that not much space for improvement is left in the field of schedule calculation algorithms; many such algorithms are proposed up to date, and they can achieve schedule lengths close to the theoretical minimum. However, the research also reveals a lack of in-detail evaluation and comparison of these algorithms; this makes choosing the most suitable algorithm for a particular application hard and performance estimation inaccurate. Therefore, an extensive evaluation of state-of-the-art TDMA protocols using simulations and over 200 randomly generated networks was performed to tackle this issue. The results allow choosing an appropriate algorithm and estimating performance for each specific application.
Next, the problem of multiple packet transmissions during a single time slot is analyzed. State-of-the-art TDMA protocols assume that one packet can be transmitted in each slot and optimize the number of slots each node gets under this assumption. However, when nodes can transmit more than one packet, the performance of such a schedule is impaired. To solve this, the M-TreeMAC protocol is proposed; this protocol considers the actual number of packets transmitted in a time slot and optimizes the schedule accordingly. Furthermore, it is observed that the routing topology heavily impacts the schedule length created using this algorithm; an algorithm that optimizes the topology to result in the shortest schedule when M-TreeMAC is used is proposed, increasing benefits even further.
Finally, the accuracy of the 2-hop interference model, commonly used by state-of-the-art TDMA scheduling algorithms, is studied and simulated using a realistic radio model based on measurement results. The results show high packet loss ratios for packets traveling a large number of hops to reach the sink. The adaptive interference model is proposed to improve the 2-hop interference model. The proposed model can increase throughput significantly in networks with a height of ten or more hops.
In this work we investigated the resistance of different kP implementations based on the Montgomery ladder against horizontal, i.e. single trace, attacks. Applying statistical methods for the analysis we were able to reveal the secret value k completely. The reason causing the success of our attacks is the key-dependent addressing of the registers and other design blocks, which is an inherent feature of binary kP algorithms. This dependency was successfully exploited in the past by Itoh et al. analyzing many hundreds of kP traces, i.e. this attack is a vertical address-bit differential power analysis attack against Montgomery ladder. The vulnerability of the Montgomery ladder against horizontal address-bit attacks was detected and demonstrated during our investigations. We were able to reveal the scalar k exploiting the address-bit vulnerability in single trace attacks using not only statistical methods, but also Fourier transform, selected clustering methods as well as one of the simplest methods – the automatized simple SCA. We performed successful horizontal address-bit SCA attacks against both types of ECs, i.e. against highly regular Montgomery ladder and against a binary kP algorithm implementing atomic patterns. The success of our attacks shows that the regularity and atomicity principles are not effective against horizontal address-bit attacks. As a means for reducing the attack success, we investigated the hiding ability of the field multiplier which is usually the largest block of kP designs. We implemented our field multiplier for ECs over prime fields corresponding to the 4-segment Karatsuba multiplication formula that reduces the execution time and the energy consumption for a kP operation by about 40 % in comparison to multipliers exploiting the classical multiplication formula. However, the energy consumption per clock remained in our multiplier without significant changes, i.e. the protective hiding properties of the multiplier as a noise source were not decreased. Another advantage of our field multiplier is its inherent resistance to horizontal collision attacks, in contrast to multipliers based on the classic multiplication formula. Additionally, we proposed regular scheduling for the block addressing as an effective strategy for reducing the success of horizontal address-bit attacks. Combining this approach with the hiding features of the field multipliers can increase the resistance of the kP designs for both types of ECs against a broad spectrum of SCA attacks. The mentioned analysis methods can be successfully applied for determining SCA leakage sources in the early design phase.
Das Internet der Dinge (IoT) und drahtlose Sensor-Netzwerke (WSNs) sind grundlegende Konzepte für die Vernetzung der heutigen globalen Informationsgesellschaft, die auf kleinen drahtlosen Geräten basiert. Wenn die Funktionalitäten oder Daten dieser Geräte manipuliert werden, kann der potenzielle Schaden erheblich sein. Daher ist die Sicherung der Datenübertragung zwischen diesen Geräten mithilfe von Kryptografie entscheidend. Die Sicherheit kryptografischer Algorithmen hängt jedoch von der Geheimhaltung der kryptografischen Schlüssel ab, die aufgrund der physischen Zugänglichkeit anfällig sein können. Side-Channel-Angriffe können diese Anfälligkeit ausnutzen, indem sie physikalische Parameter nutzen, die mit dem Betrieb kryptografischer Chips verbunden sind, wie z. B. die elektromagnetische Strahlung während kryptografischer Operationen.Als Antwort auf diese Herausforderung wurde in dieser Arbeit das "Leakage Source Cartography Tool" (LSC-Tool) entwickelt, um die Analyse der elektromagnetischen Strahlung in den elliptischen Kurvenkryptografie-Designs des IHP zu beschleunigen. Das LSC-Tool ermöglicht die automatisierte Auswertung von Sätzen von elektromagnetischen Traces, die aus verschiedenen Messpositionen über einen kryptografischen Chip gewonnen wurden. Die Analyse führt zu einer "Leakage Source Map" (LS-Map), die den Erfolg von elektromagnetischen Analyseangriffen an jeder Messposition darstellt. Dieses Tool bietet eine kostengünstige und schnelle Möglichkeit, die Widerstandsfähigkeit kryptografischer Designs gegen Angriffe zu bewerten, und bietet Designern Einblicke in die anfälligsten Bereiche des Chips sowie Informationen über den Leakage pro Taktzyklus.Durch den Einsatz des LSC-Tools wurde der Widerstand von zwei IHP ECC-Designs gegen horizontale differentielle elektromagnetische Analyseangriffe an 25 Messpositionen getestet. Die statistische Analyse von Traces kann mit drei Methoden durchgeführt werden: der Methode der kleinsten Quadrate, dem Difference-of-means-Test oder der Difference-of-the-mean-Methode. Die generierten LS-Maps zeigen, dass die Verwendung unterschiedlicher Methoden unterschiedliche Anzeichen für Leakagestellen liefert. Die Kombination dieser Karten erhöht die Erfolgsrate des Angriffs. Beachtenswert ist, dass im Laufe dieser Forschung klar wurde, dass das LSC-Tool angepasst werden kann, um LS-Maps für die funktionellen Blöcke von ECC-Designs zu erstellen und so die Analyse simulierter Power-Traces für das IHP ECC-Designs zu ermöglichen.
Mathematically, cryptographic approaches are secure. This means that the time an attacker needs for finding the secret by brute forcing these approaches is about the time of the existence of our world. Practically, an algorithm implemented in hardware is a device that generates a lot of additional data during the calculation process. Its power consumption, electromagnetic radiation, etc. can be measured, saved and analysed for key extraction. Such attacks are called side channel analysis attacks and are significant threats when applying cryptographic algorithms. By considering these attacks when implementing a cryptographic algorithm, it is possible to design an implementation that is more resistant against them.
The goal of this thesis was to design a methodology to securely implement the Montgomery kP-operation using an IHP implementation as a starting point. In addition, the area and energy consumption of the secure Montgomery kP-multiplier should still be highly efficient. The resistance against power analysis attacks of two different IHP ECC implementations was analysed in this thesis. A horizontal power analysis attack using the difference-of-means test was performed with the goal of finding potential leakage sources exploited in side channel analysis attacks, i.e. finding the reasons of a correct extraction of the cryptographic key. For both analysed ECC designs, four key candidates were extracted with a correctness of 90% or more. Through analysis of the implemented Montgomery kP-algorithm’s functionality and its power consumption, it was established that the algorithm’s operation execution flow was the main cause of the implementations’ vulnerability. Thus, a design methodology consisting in changing the Montgomery kP-algorithm operation flow was developed. As a result, the re-designed implementations do not deliver any correctly extracted key candidates whenever the difference-of-means test is performed on them. These re-designs implied an increase on the chip area by about 5% for each implementation. The execution time needed for performing a complete kP-operation was reduced for both designs. Thereby one implementation’s execution time was reduced by 12% in comparison to its original version and even though its power consumption was increased by 9%, its energy consumption per kP-operation was reduced by 4.5%.
Definition and configuration of reliable event detection for application in wireless sensor networks
(2010)
Ubiquitous systems based on wireless sensor networks will amazingly increase our quality of life. These systems are to be deployed in large areas with high density where hundreds or thousands of nodes are used. Certainly that demands to use low cost devices with limited resources, which in turn are prone to faulty behaviour. This work introduces a novel concept for wireless sensor network configuration considering fault tolerance, energy efficiency and convenience as primary goals while being tailored to user needs. It allows to ignore low-level details like node resources, network structures, node availability etc. and enables the programmer to work on a high abstraction level, namely the event itself including event related constraints. The definition of events characterising real world phenomena is of prominent use in sensor networks. The presented concept autonomously configures and monitors events, even if it requires to organise collaboration between nodes to deliver the results. The contribution of this work is threefold. An intuitive XML-based ESL simplifies event configuration to a level that is even suitable for non-professionals. It features hardware independent description elements to define complex phenomena and enhances these by tailor-made voting schemes and application constraints. Based on that, a novel, fully decentralised mechanism to autonomously set up distributed event detection called EDT and a cost efficient means to maintain such EDT, are presented. EDTs can be efficiently constructed on every device by using a tiny generating finite state machine requiring eight states only. It enables every node to self-divide event queries according to its own resources and self-adapt to the tasks assigned. Simultaneously, the EDT provides the interface for efficient collaboration using a lease-based publish/subscribe approach. The simulations clearly show that this concept works well and the applied collaboration scheme outperforms even idealised acknowledgement-based approaches. On top of the EDT, a means is developed that enhances the reliability of detection beyond the scope of Boolean event decision. It examines behavioural trends in sensor readings to indicate the significance of actual measurements in relation to the configured event. Measured data is investigated in detail to finally attach a significance indicator "is" to each event. This automatically generated indicator shall support users or overlaying systems in decision-making. In the example scenario based on data of real test cases, the "is" indicates a flaming fire 88 seconds and a smouldering fire 48 seconds before the threshold-based method triggers the alarm.
Privacy issues are becoming more and more important, especially since the cyber and the real world are converging up to certain extent when using mobile devices. Means that really protect privacy are still missing. The problem is, as soon as a user provides data to a service provider the user looses control over her/his data. The simple solution is not to provide any data but then many useful services, e.g., navigation applications, cannot be used. The dissertation addresses two aspects of privacy protection. The first aspect regards not producing private information if possible. Such unnecessary information are traces of access controlled service uses. Hence, one approach in this dissertation enables k-anonymous authorization for services uses. It equips the users of the system with trusted pseudonymous certificates reflecting their respective authorizations. Analogous to anonymous e-cash, the certificates are issued by a trusted authority with knowledge of the actual authorizations of an identified user. The certificates can be verified by any service supported by the trusted authority but without knowledge of the user’s identity. Not even the issuing authority is able to reveal the users identity from the pseudonym of a certificate. Hence, service usage cannot be tracked, neither by the service nor by the authority. This protects the privacy of service usage behavior of users. The second aspect of privacy protection is to remain in control over private data released to others. Temporary release of private data is essential to context-sensitive services, which rely on these context data to provide or improve added value. Therefore, the dissertation designs a Privacy Guaranteeing Execution Container (PGEC), which enables applications to access private user data and guarantees that the user data is deleted as soon as the service or application is finished. Basically, the concept is that the application obtains access to the user data in a specially protected and certified environment, the PGEC. The PGEC also restricts the communication between the application and the service provider to what is explicitly allowed by the service user. In addition to those means, the PGEC also implements countermeasures against malicious attacks such as modified host systems and covert channel attacks, which might be misusing CPU load to signal data out of the PGEC. Thus, the PGEC guarantees a “one time use” of the provided private data.
Programmable Logic Controllers (PLCs) are pivotal in Critical Infrastructures (CIs) and Industrial Control Systems (ICSs), governing processes in nuclear power plants, petrochemical factories, and water treatment systems. Despite their importance, PLCs are vulnerable to security threats, notably control logic injection attacks, aiming to sabotage physical processes. This thesis delves into PLC security, analyzing vulnerabilities in non-cryptographically and cryptographically protected PLCs, particularly Siemens S7-300 and S7-1500 models.
Siemens, an automation market leader, utilizes S7-300 PLCs in millions of applications, reflecting the broader ICS security landscape. The S7-1500 line claims resistance to cyberattacks, including control logic injections. The thesis evaluates authentication in non-cryptographically protected PLCs, introducing a stealthy control logic injection attack scenario using an S7-300 PLC and S7Comm protocol.
The second part explores integrity checks in cryptographically protected S7-1500 PLCs. Findings, encompassing disclosed vulnerabilities, lead to a severe control logic injection attack with a malicious interrupt block, conducted in an industrial setting using the S7-1500 and S7CommPlus protocol.
The final segment focuses on Profinet protocol security and an injection attack scenario. The study demonstrates adversaries manipulating critical data without prior knowledge, causing harm to physical processes. A real-world attack on a Profinet-based system with two S7-300 PLCs is executed.
The thesis concludes by proposing mitigation solutions, enhancing PLC and communication protocol security. This contribution elevates the security posture of millions of operating devices globally, advancing PLC security research.