Time-Print: Authenticating USB Flash Drives with Novel Timing Fingerprints
Time-Print: Authenticating USB Flash Drives with Novel Timing Fingerprints
复制标题
DOI：
10.1109/sp46214.2022.9833595
复制
发表时间：
2022-05
期刊：
影响因子：
--
通讯作者：
P. Cronin;Xing Gao;Haining Wang;Chase Cotton
中科院分区：
文献类型：
--
作者：
P. Cronin;Xing Gao;Haining Wang;Chase Cotton
通用串行总线（USB）端口是计算机系统中普遍存在的特征，并且提供了在主机和外围设备之间提供电力和数据连接的廉价且有效的方式。即使随着云计算和非现场计算的兴起，USB也在设备之间的数据传输中发挥了重要作用。它的使用在高安全性的环境中特别普遍，在这些环境中，系统是“空气间隙”的，没有连接到互联网。然而，最近的研究表明，USB并不像以前想象的那样安全，不同的攻击表明，修改USB大容量存储设备上的固件可以危及主机系统。虽然已经提出了许多防御措施，但它们需要用户交互，高级硬件支持（与传统设备不兼容）或利用可被攻击者破坏的设备标识符。在本文中，我们提出了时间打印，一种新的基于时间的指纹识别方法，用于识别USB大容量存储设备。我们通过对驱动器上不同位置的一系列读取操作进行计时来创建指纹，因为计时变化是唯一的，足以识别单个USB设备。Time-Print开销低，完全基于软件，不需要任何额外或专门的硬件。为了验证Time-Print的有效性，我们检查了40多个USB闪存驱动器，并在多个认证场景中进行实验。实验结果显示，Time-Print可以（1）以大于99.5%的准确率识别已知/未知品牌/型号的USB设备，（2）以95%的准确率识别相同品牌/型号的可见/未见设备，以及（3）以98.7%的平均准确率对相同品牌/型号的USB设备进行分类。
Universal Serial Bus (USB) ports are a ubiquitous feature in computer systems and offer a cheap and efficient way to provide power and data connectivity between a host and peripheral devices. Even with the rise of cloud and off-site computing, USB has played a major role in enabling data transfer between devices. Its usage is especially prevalent in high-security environments where systems are ‘air-gapped’ and not connected to the Internet. However, recent research has demonstrated that USB is not nearly as secure as once thought, with different attacks showing that modified firmware on USB mass storage devices can compromise a host system. While many defenses have been proposed, they require user interaction, advanced hardware support (incompatible with legacy devices), or utilize device identifiers that can be subverted by an attacker. In this paper, we present Time-Print, a novel timing-based fingerprinting method, for identifying USB mass storage devices. We create a fingerprint by timing a series of read operations from different locations on a drive, as the timing variations are unique enough to identify individual USB devices. Time-Print is low overhead, completely software-based, and does not require any extra or specialized hardware. To validate the efficacy of Time-Print, we examine more than 40 USB flash drives and conduct experiments in multiple authentication scenarios. The experimental results show that Time-Print can (1) identify known/unknown brand/model USB devices with greater than 99.5% accuracy, (2) identify seen/unseen devices of the same brand/model with 95% accuracy, and (3) classify USB devices from the same brand/model with an average accuracy of 98.7%.