TATER: Tamper Analysis via Transient Electromagnetic Response

From Mindworks
Jump to: navigation, search

TATER will be a tamper analysis system for monitoring deterministic programs and detecting unauthorized modifications by collecting and comparing electromagnetic emanations from the target processor. Its declared purpose is to prevent changes from being made to IOT devices.

Sponsors Client declined to be named
Duration Fall 2017 - Spring 2018
Mentor
  • Dr. Feng Li
Faculty Advisor
  • Dr. Feng Li
Team Name TATER Tots
Team Members
  • Matt Waltz
  • Roy Cochran
  • Matt Covalt
  • Lydia Engerbretson
  • Hannah Pearson


Problem Statement[edit]

Background[edit]

Sometimes, it is impractical to physically modify a system in order to monitor it. The goal of TATER is to assess whether the code of a system has been changed without actually modifying the system it is monitoring, using electromagnetic signals emanating from the processor.

Specifications[edit]

Our product should not require modification of the target system. It should be sensitive enough to detect relatively small changes in the boot code but flexible enough to allow multiple configurations. It should be possible to update the monitoring system to continue correctly characterizing the boot code if it is updated. Analysis should take no longer than a couple of minutes.

Design[edit]

Alternatives and Decisions[edit]

We considered using an FPGA to process signals, but ultimately decided that the best choice for research and development purposes would be to use Linux on a laptop. This is a diagram of our setup design:

Tater-setup-summary-diagram.JPG

Our strategy is to design an antenna to pick up electromagnetic signals emanating from a processor and analyze peaks in the frequency compared with an established baseline to identify modifications in the boot code. Various statistical analysis techniques may be of use in pursuing this goal.

Antenna Design[edit]

We are still considering alternatives for the final antenna design. One of the top candidates at this point is a ferrite rod. The other likely option is a patch antenna.

Ferrite Rod[edit]

Advantages:

  • High Radiated Resistance
  • Increased Efficiency

Disadvantages:

  • Only operates on one frequency
  • Not useful at high frequencies
  • Bulky and Heavy
Ferrite Rod Antenna

Algorithm Design[edit]

We are planning to use cross correlation to align our waveform sequences, which will also allow us to compare how similar the sequences are in regards to location of peaks and time in between. In addition to using cross correlation, we also intend to compare the amplitude of the corresponding peaks found using cross correlation.

Cross Correlation[edit]
In signal processing, cross-correlation is a measure of similarity of two series as a function of the displacement of one relative to the other.

For cross correlation, the sequences we are correlating are a baseline which we have established using the average of multiple captures from known good boot code, denoted f, and the signals that are being captured from the microprocessor, denoted g. See following equation:

setup
setup


Data Pre-processing[edit]
To the right is the data pre-processing design for our algorithm analysis. We will remove signals that are not significant to our analysis by filtering out values below a certain threshold.
setup
Boot Code Verification Process[edit]
To the right is an diagram of the boot code verification process for our algorithm.
setup

Implementation and Testing[edit]

So far, we have been using a probe and an oscilloscope to collect readings from the target processor. Initial results indicate that the easiest instructions to identify are loads, stores, and port accesses.


Testing and Development Setup[edit]

Components involved: (see images below and right)

  • Target board: 1MHz ATmega328p
  • AVR Programmer for board
  • Tekbox H20 EMC Probe (Magnetic Field)
  • Tekbox 20dB Amplifier or 12V - 30dB Amplifier
  • Agilent MSO7034B 350MHz 2GSa/s Oscilloscope
  • Metal box provides shielding from outside EM signals
Testing and Development Setup
Measurement Setup


Test Results[edit]

To the left is an example of signals captured by an oscilloscope. To the right is a graph showing the difference between specific instructions and a NOP instruction.


Oscilloscope Capture
Comparison Between Instructions and NOP

Team[edit]

Name Bio Photo
Matt Waltz Matt Waltz is a senior pursuing a Bachelor’s of Science in Computer Engineering from the University of Idaho. He enjoys working with low-level architectures with emphasis on compiler infrastructure, along with secure system design and protections. Wikibio-waltz.JPG
Roy Cochran Roy Cochran is a senior pursuing a Bachelor's of Science in Electrical Engineering from the University of Idaho. He enjoys learning and applying antenna design to real life applications, and implementing additions to printed circuit boards. Cochran.JPG
Matthew Covalt Matthew Covalt is a senior pursuing a Bachelor’s of Science in Computer Engineering from the University of Idaho. He has experience working with embedded systems. He also has recent experience developing and testing bootloader firmware for Solid State Drive devices. Covalt.JPG
Lydia Engerbretson Lydia Engerbretson is a senior at the University of Idaho, pursuing a Bachelor's of Science in Computer Science. She is currently a Software Engineer Intern at Schweitzer Engineering Labs, where she writes software for Protection System relays. Lydia engerbretson.jpg
Hannah Pearson Hannah Pearson is a senior pursuing a Bachelor's of Science in Computer Science and in Mathematics. She is interested in cyber security and cryptography and likes working on CTFs in her free time. Pearson.JPG

Document Archive[edit]

Project Schedule[edit]

Project scedule.JPG

Meeting Minutes[edit]

File:Meeting Minutes 20170906.pdf

File:Meeting Minutes 20170908.pdf

File:Meeting Minutes 20170913.pdf

File:Meeting Minutes 20170914.pdf

File:Meeting Minutes 20170920.pdf

File:Meeting Minutes 20170927.pdf

File:Meeting Minutes 20171004.pdf

File:Meeting Minutes 20171011.pdf

File:Meeting Minutes 20171018.pdf

File:Meeting Minutes 20171025.pdf

File:Meeting Minutes 20171101.pdf

File:Meeting Minutes 20171108.pdf

File:Meeting Minutes 20171115.pdf

File:Meeting Minutes 20171129.pdf

File:Meeting Minutes 20171206.pdf

Presentations and Monthly Status Reports[edit]

File:Tater-msr-sept.pdf

File:Tater-msr-oct.pdf

File:Tater-msr-nov.pdf

Other Project Documents[edit]

File:Tater-tots-team-contract.pdf