In this paper, we present SobTrA, a Software-based Trust Anchor for ARM Cortex-A processors to protect systems against software-based attacks. SobTrA enables the implementation of a software-based secure boot controlled by a third party independent from the manufacturer. Compared to hardware-based trust anchors, our concept provides some other advantages like being updateable and also usable on legacy hardware. The presented software-based trust anchor involves a trusted third party device, the verifier, locally connected to the untrusted device, e.g., via the microSD card slot of a smartphone. The verifier is verifying the integrity of the untrusted device by making sure that a piece of code is executed untampered on it using a timing-based approach. This code can then act as an anchor for a chain of trust similar to a hardware-based secure boot. Tests on our prototype showed that tampered and untampered execution of SobTrA can be clearly and reliably distinguished.

In this paper, we present SobTrA, a Software-based Trust Anchor for ARM Cortex-A processors to protect systems against software-based attacks. SobTrA enables the implementation of a software-based secure boot controlled by a third party independent from the manufacturer. Compared to hardware-based trust anchors, our concept provides some other advantages like being updateable and also usable on legacy hardware. The presented software-based trust anchor involves a trusted third party device, the verifier, locally connected to the untrusted device, e.g., via the microSD card slot of a smartphone. The verifier is verifying the integrity of the untrusted device by making sure that a piece of code is executed untampered on it using a timing-based approach. This code can then act as an anchor for a chain of trust similar to a hardware-based secure boot. Tests on our prototype showed that tampered and untampered execution of SobTrA can be clearly and reliably distinguished.

Identity theft has deep impacts in today's mobile ubiquitous environments. At the same time, digital identities are usually still protected by simple passwords or other insufficient security mechanisms. In this paper, we present the TrustID architecture and protocols to improve this situation. Our architecture utilizes a Secure Element (SE) to store multiple context-specific identities securely in a mobile device, e.g., a smartphone. We introduce protocols for securely deriving identities from a strong root identity into the SE inside the smartphone as well as for using the newly derived IDs. Both protocols do not require a trustworthy smartphone operating system or a Trusted Execution Environment. In order to achieve this, our concept includes a secure combined PIN entry mechanism for user authentication, which prevents attacks even on a malicious device. To show the feasibility of our approach, we implemented a prototype running on a Samsung Galaxy SIII smartphone utilizing a microSD card SE. The German identity card nPA is used as root identity to derive context-specific identities.

We analyze the side-channel countermeasures implemented in a high-throughput AES peripheral of a commercially available microcontroller which is not dedicated to high security applications. We detect and classify the employed countermeasures and examine their effectiveness against first-order DPA attacks. We practically demonstrate, that all of the implemented countermeasures, which are common time-based hiding countermeasures, can easily be nullified with simple preprocessing methods. This is caused by the inherent properties of high-throughput designs (low number of cycles), which offers few choices for such countermeasures. Hence, we found that the effectively achieved side-channel protection is significantly lower than the theoretically expected one due to the way countermeasures are implemented and present ways to improve the effectiveness. We also reveal a design flaw in the implementation which allows timing-based attacks on the device.

Frederic Stumpf, Markus Sacher, Claudia Eckert and Alexander Rosnagel argue that the new generations of computers that include a trusted platform have the capacity of providing more reliable proof for both parties when entering contracts at a distance over the internet.

Monitoring file integrity and preventing illegal modifications is a crucial part of improving system security. Unfortunately, current research focusing on isolating monitoring components from supervised systems can often still be thwarted by tampering with the hooks placed inside of Virtual Machines (VMs), thus resulting in critical file operations not being noticed. In this paper, we present an approach of relocating a supervised VM’s entire filesystem into the isolated realm of the host. This way, we can enforce that all file operations originating from a VM (e.g., read and write operations) must necessarily be routed through the hypervisor, and thus can be tracked and even be prevented. Disabling hooks in the VM then becomes pointless as this would render a VM incapable of accessing or manipulating its own filesystem. This guarantees secure and complete active file integrity monitoring of VMs. The experimental results of our prototype implementation show the feasibility of our approach.

Measuring the integrity of critical operating system components and securely storing these measurements in a hardware-protected Trusted Platform Module (TPM) is a well-known approach for improving system security. However, currently it is not possible to securely extend this approach to TPMs used in virtualized environments. In this paper, we show how to multiplex integrity measurements of arbitrarily many Virtual Machines (VMs) with just a single standard TPM. In contrast to existing approaches such as vTPM, our approach achieves a higher level of security since measurements will never be held in software but are fully hardware-protected by the TPM at all times. We establish an integrity-protected mapping between each measurement and its respective VM such that it is not possible for an attacker to alter this mapping during remote attestation without being detected. Furthermore, all measurements will be stored in the TPM in a concealed manner in order to prevent information leakage of other VMs during remote attestation. The experimental results of our proof of concept implementation show the feasibility of our approach.

One of the main applications of Physical Unclonable Functions (PUFs) is unique key generation. While the advantages of PUF-based key extraction and embedding have been shown in several papers, physical attacks on it have gained only little interest until now. In this work, we demonstrate the feasibility of a differential power analysis attack on the error correction module of a secure sketch. This attack can also be applied to code-offset fuzzy extractors because they build upon secure sketches. We propose a codeword masking scheme to protect key generation algorithms used for PUFs. Our proposed countermeasure enables masking of linear Error-Correcting Codes (ECCs) without impact on their error correction capabilities while keeping the overhead low. This is achieved by random masking codewords, which can be efficiently generated by the ECC's encoding function. Further, it allows to consistently protect the PUF-based key generation process and can provide the masked key and its mask to a subsequent crypto module which implements masking as well. We demonstrate the practical protection of our codeword masking scheme by attacking a masked secure sketch implementation. We emphasize that, besides protecting code-offset algorithms, the proposed masking scheme can also be applied to index-based syndrome coding and other security-critical error correction modules.

Fault tolerant software against fault attacks constitutes an important class of countermeasures for embedded systems. In this work, we implemented and systematically analyzed a comprehensive set of 19 different strategies for software countermeasures with respect to protection effectiveness as well as time and memory efficiency. We evaluated the performance and security of all implementations by fault injections into a microcontroller simulator based on an ARM Cortex-M3. Our results show that some rather simple countermeasures outperform other more sophisticated methods due to their low memory and/or performance overhead. Further, combinations of countermeasures show strong characteristics and can lead to a high fault coverage, while keeping additional resources at a minimum. The results obtained in this study provide developers of secure software for embedded systems with a solid basis to decide on the right type of fault attack countermeasure for their application.

Among all proposed Physical Unclonable Functions (PUFs), those based on Ring Oscillators (ROs) are a popular solution for ASICs as well as for FPGAs. However, compared to other PUF architectures, oscillators emit electromagnetic (EM) signals over a relatively long run time, which directly reveal their unique frequencies. Previous work by Merli et al. exploited this fact by global EM measurements and proposed a countermeasure for their attack. In this paper, we first demonstrate that it is feasible to measure and locate the EM emission of a single tiny RO consisting of only three inverters, implemented within a single configurable logic block of a Xilinx Spartan-3A. Second, we present a localized EM attack for standard and protected RO PUFs. We practically investigate the proposed side-channel attack on a protected FPGA RO PUF implementation. We show that RO PUFs are prone to localized EM attacks and propose two countermeasures, namely, randomization of RO measurement logic and interleaved placement.

In this paper, we propose a lightweight mechanism to isolate one or more Android userland instances from a trustworthy and secure entity. This entity controls and manages the Android instances and provides an interface for remote administration and management of the device and its software. Our approach includes several security extensions for secure network access, integrity protection of data on storage devices, and secure access to the touchscreen. Our implementation requires only minimal modification to the software stack of a typical Android-based smartphone, which allows easy porting to other devices when compared to other virtualization techniques. Practical tests show the feasibility of our approach regarding runtime overhead and battery lifetime impact.

We propose a novel privacy-preserving scheme for LTE in vehicular communication. The main idea behind our concept is to include original equipment manufacturers (OEM) of vehicular stations in the mobile connection's life cycle. Our scheme makes use of pseudonymous identifiers and splits the identity management for communicating vehicles between mobile network operators and OEMs. We show that our scheme improves the privacy of subscribers without loss of functionality in terms of all relevant use cases for vehicular communication over LTE.

We present a new architecture for a secure smart metering system. Our architecture is based on a special purpose hardware security module that encapsulates all security critical operations and provides the main functionality of the system in an active role. This new approach enables secure meter data handling within the smart grid. As a result, our architecture preserves the privacy of sensitive consumer data and the integrity of meter data. Additionally, our proposed solution enhances the security of components critical to the operation of the power grid.

In this contribution, we present Complementary Index-Based Syndrome coding (C-IBS), a new and flexible fuzzy embedder for Physical Unclonable Functions (PUFs). C-IBS applies IBS several times to the same group of PUF outputs. The additional parameter permits an application specific tradeoff between error correction capability and implementation complexity. We demonstrate the flexibility of C-IBS by providing efficient solutions that optimize error correction, helper data size or decoder complexity for a well-known key generation scenario. Further, we present encoding criteria that characterize C-IBS fuzzy embedders in general. A hardware implementation is compared to previous work and substantiates the efficiency of C-IBS. The low implementation complexity of C-IBS facilitates the usage for resource constrained cryptographic applications.

We show in this paper that the isolation characteristic of system virtualization can be bypassed by the use of a cache timing attack. Using Bernstein’s correlation in this attack, an adversary is able to extract sensitive keying material from an isolated trusted execution domain. We demonstrate this cache timing attack on an embedded ARM-based platform running an L4 microkernel as virtualization layer. An attacker who gained access to the untrusted domain can extract the key of an AES-based authentication protocol used for a financial transaction. We provide measurements for different public domain AES implementations. Our results indicate that cache timing attacks are highly relevant in virtualization-based security architectures, such as trusted execution environments.

High resolution inductive probes enable precise measurements of the electromagnetic field of small regions on integrated circuits. These precise measurements allow to distinguish the activity of registers on the circuit that are located at different distances to the probe. This location-dependent information can be exploited in side-channel analyses of cryptographic implementations. In particular, cryptographic algorithms where the usage of registers depends on secret information are affected by side-channel attacks using localized electromagnetic analysis. Binary exponentiation algorithms which are used in public key cryptography are typical examples for such algorithms. This article introduces the concept of localized electromagnetic analysis in general. Furthermore, we present a case study where we employ a template attack on an FPGA implementation of the elliptic curve scalar multiplication to prove that location-dependent leakage can be successfully exploited. Conventional countermeasures against side-channel attacks are ineffective against location-dependent side-channel leakage. As an effective general countermeasure, we promote that the assignment of registers to physical locations should be repeatedly randomized during execution.

Distributed denial of service (DDoS) attacks from a large number of compromised mobile devices are a major threat to mobile networks. In this paper, we present a concept, an architecture, and a protocol for a hardware-based attestation which enables mobile devices to efficiently prove that their baseband stack is still trustworthy. Our attestation mechanism enables verification of the baseband stack without using expensive asymmetric cryptographic operations, maintains the ability to update (or recover) the baseband binary, and allows the network to enforce a certain version, state, or configuration of the baseband at network connect. Our approach represents an efficient method to block devices with a compromised baseband stack and thus prevents distributed denial of service attacks to mobile networks.

In this contribution, we present an FPGA-based simulation environment for fault attacks on cryptographic hardware designs. With our methodology, we are able to simulate the effects of global fault attacks from e.g., spikes and local attacks from e.g., focused laser beams. The environment simulates transient bit-flip faults in sequential elements of a digital design. In this way it is tailored to the simulation of fault attacks on cryptographic designs. It is a tool to verify the design's behaviour in case of fault attacks and to verify implemented countermeasures. The environment is script-based for fully automated modification of the digital design and simulation. It can handle designs in VHDL as well as in Verilog language and does not require modifications to the design's source code. We used our environment in a case study and successfully tested the effectiveness of a fault detection countermeasure in an elliptic curve cryptography design.