ITR: Architecture for Surviving Denial-of-Service Attacks on Battery-powered Mobile Computers

电池供电的计算设备的不断扩散创造了一种新型的“拒绝服务”攻击：如果攻击者可以耗尽设备的电池，例如，通过让它重复执行一个耗电的程序，设备将无法运行。与其他拒绝服务攻击不同，攻击者必须保持攻击才能继续拒绝服务，攻击者可以在电池完全放电后停止攻击电池供电的设备，并继续攻击另一个设备。正如计算机网络的出现使计算机病毒、特洛伊木马和其他计算机安全漏洞的数量增加一样，移动计算设备的日益普及和对移动计算设备的日益依赖将导致“与电力有关的安全攻击”的产生和传播。因此，移动计算设备中的电池是一个易受攻击的点，必须加以保护。这项研究的目的是防御对电池的攻击。在典型的移动计算机中，电池在一组使用条件下有望提供一定的电池寿命，其中用户在一小部分时间内积极使用设备，而设备在其余时间处于空闲状态。当设备处于空闲状态时，电源管理软件会将设备置于低功耗待机和睡眠模式，从而延长设备的电池寿命。如果攻击者可以通过使设备处于激活状态来阻止设备进入低功耗模式，则可以大大缩短电池寿命。攻击者耗尽电池的主要方法有三种：(1)服务请求攻击，即向受害者重复请求服务，通常是通过网络进行的——即使没有提供服务，受害者也必须消耗能量来决定是否履行请求；(2)良性权力病毒，受害者被要求重复执行有效但耗能的任务；(3)恶性权力病毒，攻击者修改程序，使其消耗更多的能量。正在进行的研究通过定义(1)用于保证最低电池寿命的移动计算设备的电源安全架构和(2)用于识别与电源相关的安全漏洞的设计流程来防御这些攻击。防止对设备电池的攻击，包括业务请求攻击、良性电源病毒攻击和恶性电源病毒攻击，最大限度地延长设备电池的使用寿命。整体的电力安全架构采用了多层认证和能源签名监控两大基本安全特性：多层认证确保所有不可信的业务都消耗一定的能源。额外的资源只承诺给那些获得更高信任级别的请求者。能源签名监视器捕获那些进入系统以执行耗能应用程序或服务的入侵。该研究包括以下任务：*服务分类以保证最短的任务时间*为可信服务请求生成、捕获和验证能源签名*通过实施与电源相关的安全攻击来验证体系结构该项目对信息技术的最新状态有许多直接的好处。首先，它保护电池供电的移动计算系统免受潜在的破坏性安全攻击，而移动计算系统是信息技术基础设施中日益重要的一部分。其次，它探索了一个新的问题，吸引了人们对一个应该由大量研究人员研究的领域的关注。这项研究的更广泛的影响是确保移动计算对不断增长的社区继续具有吸引力。通过防止基于电池的安全攻击，这项工作确保了移动计算被更广泛的社会群体所采用。

The ongoing proliferation of battery-powered computing devices has created a new type of "denial of service" attack: If an attacker can drain a device's battery, for example, by having it repeatedly execute a energy-hungry program, the device will be rendered inoperable. Unlike other denial-of-service attacks where the attacker must keep up the attack in order to continue to deny the service, the attacker can quit attacking a battery-powered device once she has fully discharged thebattery, and move on to attack another device. Just as the advent of computer networks enabled an increase in the number of computer viruses, Trojan horses, and other computer security breaches, the rising availability of and increasing dependence on mobile computing devices will lead to the creation and spread of "power-related security attacks." The battery in a mobile computing device is thus a point of vulnerability and must be protected. The purpose of this research is to defend against attacks on the battery.In a typical mobile computer, the battery is expected to give a certain battery life under a set of usage conditions where the user is actively using the device for a small fractionof the time, and the device is idle the rest of the time. When the device is idle, power management software puts thedevice into low power standby and sleep modes, extending the device's battery life. If an attacker can prevent the device from entering low power modes by keeping it active, the battery life can be drastically shortened. There are three main methods for an attacker to drain the battery: (1)Service request attacks, where repeated requests are made to the victim for services, typically over a network--even if the service is not provided, the victim must expend energy deciding whether or not to honor the request; (2) benign power viruses, where the victim is made to execute a valid but energy-hungry task repeatedly, and (3) malignant power viruses, where an attacker modifies a program to make it consume more energy than it would otherwise.The ongoing research defends against these attacks by defining (1) a power-secure architecture for mobile computing devices that guarantees a minimum battery life, and (2) a design flow for identifying power-related security vulnerabilities. This work guarantees a minimum battery life by guarding against attacks on the device's battery, including service request attacks, benign power viruses, and malignant power viruses. The overall power-secure architecture employs twofundamental security features in the system, multi-layer authentication and energy signature monitor: The multi-layer authentication ensures that all untrusted services rendered consume less than a certain amount of energy. Additional resources are committed only to those requesters who have obtained further levels of trust. The energy signature monitor catches those intrusions that have entered the system to execute an energy-hungry application or service. The researchconsists of the following tasks:* Classification of services to guarantee minimum mission time* Generation, capture, and validation of energy signaturesfor trusted service requests* Validation of the architecture by implementing power-relatedsecurity attacksThis project has a number of direct benefits to the stateof the art in information technology. First, it protects battery-powered mobile computing systems, an increasingly important portion of the information technology infrastructure, from a potentially devastating form of security attack. Second, it explores a new problem and attracts attention to an areathat should be studied by a large community of researchers.The broader impact of the this research is to ensure that mobile computing continues to be attractive to a growing community. By protecting against battery-based security attacks, this work ensures the ongoing adoption of mobile computing by a wider segment of society.