Abstract
Recent research demonstrates that adversaries can inject malicious code into a peripheral’s firmware during a firmware update, which can result in password leakage or even compromise of the whole host operating system. Therefore, it is desirable for a host system to be able to verify the firmware integrity of attached peripherals. Several software-based attestation techniques on embedded devices have been proposed as potentially enabling firmware verification. In this work, we propose a Software-Based Attestation technique for Peripherals that verifies the firmware integrity of a peripheral and detects malicious changes with a high probability, even in the face of recently proposed attacks. We implement and evaluate SBAP in an Apple Aluminum Keyboard and study the extent to which our scheme enhances the security properties of peripherals.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
Chen, K.: Reversing and exploiting and apple firmware update. In: Black Hat. (July 2009)
Seshadri, A., Perrig, A., van Doorn, L., Khosla, P.: Swatt: Software-based attestation for embedded devices. In: Proceedings of the IEEE Symposium on Security and Privacy (2004)
Seshadri, A., Luk, M., Perrig, A., van Doorn, L., Khosla, P.: Scuba: Secure code update by attestation in sensor networks. In: ACM Workshop on Wireless Security (WiSe 2006) (2006)
Seshadri, A., Luk, M., Perrig, A., Van Doorn, L., Khosla, P.: Sake: Software attestation for key establishment in sensor networks. In: Nikoletseas, S.E., Chlebus, B.S., Johnson, D.B., Krishnamachari, B. (eds.) DCOSS 2008. LNCS, vol. 5067, pp. 372–385. Springer, Heidelberg (2008)
Castelluccia, C., Francillon, A., Perito, D., Soriente, C.: On the difficulty of software-based attestation of embedded devices. In: Proceedings of ACM Conference on Computer and Communications Security (CCS) (November 2009)
CYPRESS: Cypress encore ii low-speed usb peripheral controller (cy7c639xx)
Huffman, D.: A method for the construction of minimum redundancy codes. In: Proceedings of the IRE 40 (1962)
Buchanan, E., Roemer, R., Shacham, H., Savage, S.: When good instructions go bad: Generalizing return oriented programming to risc. In: Proceedings of the ACM Conference on Computer and Communications Security (CCS) (October 2008)
Hund, R., Holz, T., Freiling, F.: Return oriented rootkit: Bypassing kernel code integrity protection mechanisms. In: Proceedings of the 18th USENIX Security Symposium (August 2009)
Shacham, H.: The geometry of innocent flesh on the bone: Return into libc without function calls (on the x86). In: Proceedings of the ACM Conference on Computer and Communications Security (CCS) (2007)
Klimov, A., Shamir, A.: A new class of invertible mappings. In: Kaliski Jr., B.S., Koç, Ç.K., Paar, C. (eds.) CHES 2002. LNCS, vol. 2523, pp. 470–483. Springer, Heidelberg (2003)
wikipedia, http://en.wikipedia.org/wiki/rc4
Hars, L., Petruska, G.: Pseudo-random recursions: Small and fast pseudo-random number generator for embedded applications. EURASIP Journal on Embedded Systems (2007)
Yang, Y., Wang, X., Zhu, S., Cao, G.: Distributed software-based attestation for node compromise detection in sensor networks. In: Proceedings of IEEE International Symposium on Reliable Distributed Systems (2007)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2010 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Li, Y., McCune, J.M., Perrig, A. (2010). SBAP: Software-Based Attestation for Peripherals. In: Acquisti, A., Smith, S.W., Sadeghi, AR. (eds) Trust and Trustworthy Computing. Trust 2010. Lecture Notes in Computer Science, vol 6101. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-13869-0_2
Download citation
DOI: https://doi.org/10.1007/978-3-642-13869-0_2
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-13868-3
Online ISBN: 978-3-642-13869-0
eBook Packages: Computer ScienceComputer Science (R0)