Towards Adversarial Process Control on Inertial Sensor Systems with Physical Feedback Side Channels
Towards Adversarial Process Control on Inertial Sensor Systems with Physical Feedback Side Channels
复制标题
DOI：
10.1145/3605758.3623494
复制
发表时间：
2023-11
期刊：
影响因子：
--
通讯作者：
Yazhou Tu;Sara Rampazzi;X. Hei
中科院分区：
文献类型：
--
作者：
Yazhou Tu;Sara Rampazzi;X. Hei
实际过程控制需要连续的传感器测量和环境的自动控制。典型的过程控制系统由三个主要部分组成：作为系统“大脑”的控制器，作为测量设备的传感器，以及修改环境的最终控制元件。先前的工作表明，对手可以将信号注入模拟传感器以影响控制过程;然而，在传统的物理级传感器信号注入攻击中，实现过程控制所必需的对抗控制器本质上是缺失的，这揭示了干扰传感器系统的机制，但没有描述随着时间的推移调整和调节过程所需的计算。本文介绍了一种对抗性控制回路的方法，计算攻击过程中的攻击信号，以指导对抗性的过程控制。我们的方法允许用程序构建对抗过程控制的外部“大脑”。此外，我们还描述了带外信号注入攻击中的物理反馈侧通道（PFSC），并研究了如何非侵入性地构建对抗原型系统，以获得对两种类型惯性传感器-致动器系统的控制，包括MegaWheels自平衡滑板车。我们演示了概念验证流程控制，而无需访问或篡改受害系统的内部模块。
Real-world process control requires continuous sensor measurements and automatic control of the environment. Typical process control systems consist of three main components: controllers functioning as the system's "brain'', sensors acting as measurement devices, and final control elements that modify the environment. Prior works showed that adversaries could inject signals into analog sensors to affect the control process; however, an adversarial controller that is necessary to achieve process control is inherently missing in conventional physical-level sensor signal injection attacks, which revealed mechanisms to perturb sensor systems but did not describe the computations necessary to adjust and regulate the process over time. This paper introduces an adversarial control loop approach that computes attack signals during the attack to guide the adversarial process control. Our approach allows constructing the external "brain'' of the adversarial process control with programs. Further, we characterize the Physical Feedback Side Channel (PFSC) in out-of-band signal injection attacks, and study how the adversarial prototype system can be constructed non-invasively to gain control over two types of inertial sensor-actuator systems, including a MegaWheels self-balancing scooter. We demonstrate proof-of-concept process control without accessing or tampering with internal modules of the victim system.