Injected and Delivered: Fabricating Implicit Control over Actuation Systems by Spoofing Inertial Sensors
Injected and Delivered: Fabricating Implicit Control over Actuation Systems by Spoofing Inertial Sensors
复制标题
DOI：
--
复制
发表时间：
2018-06
期刊：
影响因子：
--
通讯作者：
Yazhou Tu;Zhiqiang Lin;Insup Lee;X. Hei
中科院分区：
文献类型：
--
作者：
Yazhou Tu;Zhiqiang Lin;Insup Lee;X. Hei
惯性传感器为控制系统提供重要的反馈，以确定运动状态并做出及时的自动决策。先前的努力试图用声信号控制惯性传感器的输出。然而，他们的方法没有考虑模数转换器中的采样率漂移以及许多其他现实因素。因此，很少有攻击能够有效控制嵌入实际系统中的惯性传感器。这项工作研究带外信号注入方法，为嵌入式 MEMS 惯性传感器提供对抗性控制，并评估依赖它们的控制系统中暴露的后续漏洞。注入惯性传感器的声学信号是带外模拟信号。因此，轻微的采样率漂移可能会被放大并导致数字信号频率的偏差。这种偏差会导致传感器输出波动；尽管如此，我们还是描述了两种控制输出的方法：数字幅度调整和相位调节。根据我们的分析，我们设计了非侵入式攻击来操纵传感器输出以及派生的惯性信息来欺骗控制系统。我们测试了 25 个配备 MEMS 惯性传感器的设备，发现其中 17 个可以被我们的攻击隐式控制。此外，我们研究了我们的方法的普遍性，并展示了通过传感通道中频率相对较低的信号来操纵数字输出的可能性。
Inertial sensors provide crucial feedback for control systems to determine motional status and make timely, automated decisions. Prior efforts tried to control the output of inertial sensors with acoustic signals. However, their approaches did not consider sample rate drifts in analog-to-digital converters as well as many other realistic factors. As a result, few attacks demonstrated effective control over inertial sensors embedded in real systems. This work studies the out-of-band signal injection methods to deliver adversarial control to embedded MEMS inertial sensors and evaluates consequent vulnerabilities exposed in control systems relying on them. Acoustic signals injected into inertial sensors are out-of-band analog signals. Consequently, slight sample rate drifts could be amplified and cause deviations in the frequency of digital signals. Such deviations result in fluctuating sensor output; nevertheless, we characterize two methods to control the output: digital amplitude adjusting and phase pacing. Based on our analysis, we devise non-invasive attacks to manipulate the sensor output as well as the derived inertial information to deceive control systems. We test 25 devices equipped with MEMS inertial sensors and find that 17 of them could be implicitly controlled by our attacks. Furthermore, we investigate the generalizability of our methods and show the possibility to manipulate the digital output through signals with relatively low frequencies in the sensing channel.