Non-intrusive runtime monitoring through power consumption to enforce safety and security properties in embedded systems

Abstract

The increasing complexity and connectivity of modern embedded systems highlight the importance of runtime monitoring to ensure correctness and security. This poses a significant challenge, since monitoring tools can break extra-functional requirements such as timing constraints. Non-intrusive program tracing through side-channel analysis techniques have recently appeared in the literature and constitute a promising approach. Existing techniques, however, exhibit important limitations. In this paper, we present a novel technique for non-intrusive program tracing from power consumption, based on a signals and system analysis approach: we view the power consumption signal as the output of a system with the power consumption of training samples as input. Using spectral analysis, we compute the impulse response to identify the system; the intuition is that for the correct training sample, the system will appear close to a system that outputs a shifted copy of the input signal, for which the impulse response is an impulse at the position corresponding to the shift. We also use the Control Flow Graph from the source code to constrain the classifier to valid sequences only, leading to substantial performance improvements over previous works. Experimental results confirm the effectiveness of our technique and show its applicability to runtime monitoring. The experiments include tracing programs that execute randomly generated sequences of functions as well as tracing a real application developed with SCADE. The experimental evaluation also includes a case-study as evidence of the usability of our technique to detect anomalous execution through runtime monitoring.

Appendices

Appendix A: Instrumentation of the source code

Below are examples of the two instrumented versions of the source code for the case of the ADPCM coder.

Appendix B: Randomized sequences of functions

Below is an example of a randomized sequence of functions. The program running on Workstation 1 randomly chooses the 64-bit seed for the rnd64 PRNG, as well as the choice of functions at each step (for example, encrypt and crc32buf were randomly chosen for the first step, sha_update and adpcm_coder for the second step, and so on).

The function randomize_data uses rnd64 to generate pseudorandom input data for the functions. Every eight steps (eight if statements) we re-randomize and assign a new random value into rnd, since each step consumes one of its eight random bits.