© 2012 Nathan J. Edwards HARDWARE INTRUSION DETECTION FOR SUPPLY-CHAIN THREATS TO CRITICAL INFRASTRUCTURE EMBEDDED SYSTEMS BY NATHAN J. EDWARDS THESIS Submitted in partial fulfillment of the requirements for the degree of Master of Science in Electrical and Computer Engineering in the Graduate College of the University of Illinois at Urbana-Champaign, 2012 Urbana, Illinois Adviser: Professor David M. Nicol ABSTRACT Along with an increase in cyber security concerns for critical infrastructure applications, there is a growing concern and lack of solutions for cyber-based supply chain and device life- cycle threats. The challenge for this application space is that cost-driven engineering and market viability requires the use of commercially available off-the-shelf (COTS) components or just-in- time (JIT) manufacturing processes for sub-assemblies most of which originate from unsecured foreign facilities. In addition, many of the deployed embedded system devices are easily accessible (i.e. poor physical security) and can easily be tampered with or altered during their life-cycle such that the authentication or integrity of the devices cannot be assured. In this research I propose the foundations of a new technology that helps address these growing issues with a hardware-based intrusion detection system. This technology combines the use of an analog signal response from a resistor-capacitor circuit and machine learning techniques to not only identify the presence of a hardware Trojan on an inter-chip communication bus at 100% accuracy for the dataset of over 2000 measurements, but which also correctly distinguishes between several types of implanted Trojans at 89% accuracy. And while this research has focused on the security of inter-chip communication, it demonstrates the possibility of using low- power analog signals for device-level information assurance. ii To my wife and three children, for their love, support, and understanding of time spent away from home to build electronic gadgets and participate in a greater science. Jesus looked at them and said, “With man this is impossible, but with God all things are possible.” Matthew 19:26 (NIV) iii ACKNOWLEDGMENTS Some of the materials contained herein are subject to pending patent application(s) This material is based upon work supported by United States Department of Energy’s National Nuclear Security Administration under contract DE-AC04-94AL85000, and by United States Department of Energy’s Office of Electricity Delivery and Energy Reliability contract award number DE-OE0000097 (Trustworthy Cyber Infrastructure for the Power Grid). The author acknowledges the support and guidance of many great research staff and faculty at the University of Illinois at Urbana-Champaign and at Sandia National Laboratories. iv TABLE OF CONTENTS LIST OF TABLES ................................................................................................................... viii LIST OF FIGURES ................................................................................................................... ix LIST OF ABBREVIATIONS ................................................................................................... xii CHAPTER 1 INTRODUCTION ............................................................................................. 1 1.1 The Importance of Security Research on Advanced Metering Infrastructure .............. 2 1.2 Summary of Key Issues in Supply Chain and Product Lifecycle................................. 3 1.3 Research Goals ............................................................................................................. 3 1.4 Research Objectives ..................................................................................................... 4 1.5 Fundamental Questions ................................................................................................ 4 1.6 Design Challenges ........................................................................................................ 4 CHAPTER 2 CYBERSECURITY ISSUES IN CRITICAL INFRASTRUCTURE SUPPLY CHAIN AND DEVICE LIFECYCLE ........................................................................................ 5 2.1 Lifecycle of an Embedded System Device ................................................................... 5 2.2 Supply Chain Concerns: A Real Problem .................................................................... 8 2.3 Supplier Evaluation and Vetting................................................................................... 9 2.4 Existing Practices for Functional Verification Testing .............................................. 10 2.5 Just-in-Time Manufacturing ....................................................................................... 12 2.6 Vulnerabilities in the Supply Chain............................................................................ 13 CHAPTER 3 EMBEDDED SYSTEMS HARDWARE THREAT MODEL ........................ 16 3.1 Overview .................................................................................................................... 16 3.2 Taxonomy of Hardware-Based Cyber Attacks ........................................................... 16 3.3 Threat Model for Embedded Systems Hardware ....................................................... 17 3.4 Approaches to Hardware Intrusion Detection and Prevention ................................... 20 CHAPTER 4 HARDWARE-BASED INTRUSION DETECTION USING RESISTOR- CAPACITOR CIRCUITS: A NEW APPROACH ................................................................... 22 4.1 Description of Hardware ............................................................................................ 22 4.2 Concept of Operation .................................................................................................. 23 4.3 Intrusion Detection Measurements ............................................................................. 24 4.4 System Integration ...................................................................................................... 24 4.5 Example Use Cases .................................................................................................... 27 4.6 Theoretical Basis on Principles of Energy Conservation: KVL and KCL ................. 30 v 4.7 Voltage Response of Two-Stage RC Circuit .............................................................. 31 4.8 Environment, Aging Degradation, and Effect of Temperature on the IDS Circuit .... 32 CHAPTER 5 SMART METER RESEARCH PLATFORM ................................................. 34 5.1 General Capabilities ................................................................................................... 34 5.2 External Communication Interfaces ........................................................................... 35 5.3 Microprocessor Hardware .......................................................................................... 36 5.4 Experiment and Monitoring Interfaces ....................................................................... 37 5.5 Power Supply and Noise Suppression ........................................................................ 37 CHAPTER 6 DESIGN OF EXPERIMENTS ........................................................................ 39 6.1 Considerations for Sampling Time ............................................................................. 39 6.2 Considerations for Areas Under the Curve................................................................. 39 6.3 Design of Experiment ................................................................................................. 40 6.4 Experimental Test Setup ............................................................................................. 42 CHAPTER 7 GRAPHICAL ANALYSIS.............................................................................. 44 7.1 The Goals of Graphical Analysis ................................................................................ 44 7.2 Oscilloscope Trace Observations ............................................................................... 44 7.3 Graphical Analysis of Statistical Data ........................................................................ 45 CHAPTER 8 CHARACTERIZATION OF THE SYSTEM NOISE .................................... 50 8.1 Importance of Noise Characterization ........................................................................ 50 8.2 Collecting Noise Data ................................................................................................. 50 8.3 Analysis of System Noise ........................................................................................... 51 CHAPTER 9 IDS MODEL DEVELOPMENT & STATISTICAL ANALYSIS USING LOGISTIC REGRESSION ....................................................................................................... 53 9.1 The Selection of Analysis Methodology for Intrusion Detection............................... 53 9.2 Overview of Multinomial Logistic Regression .......................................................... 55 9.3 Intrusion Detection Model Development and Goodness-of-Fit ................................. 57 9.4 Intrusion Detection Model Performance .................................................................... 60 9.5 Receiver Operating Characteristic Curves ................................................................. 63 9.6 Sensitivity, Specificity, and Precision Curves ............................................................ 65 CHAPTER 10 FUTURE