Sensor CON-Fusion: Defeating Kalman Filter in Signal Injection Attack

ABSTRACT

In recent years, information systems have become increasingly able to interact with the real world by using relatively cheap connected embedded devices. In such systems, sensors are crucial components because systems can observe the real world only through sensors. Recently, there have been emerging threats to sensors, which involve the injection of false information in the physical/analog domain. To counter such attacks, sensor fusion is considered a promising approach because the robustness of a measurement can be improved by combining data from redundant sensors. However, sensor fusion algorithms were not originally designed to consider security, and thus their effectiveness is unclear. For this reason, in this paper, we evaluate in detail the security of sensor fusion. Notably, we consider a sensor fusion scenario that involves measuring inclination, with a combination of an accelerometer, gyroscope, and magnetometer using Kalman filter. Based on a theoretical analysis of the algorithm, two concrete attacks that defeat the sensor fusion are proposed. The feasibility of the proposed attacks is verified by performing experiments in emulated and real environments. We also propose a countermeasure that thwarts the new attacks. Furthermore, we logically prove that the proposed countermeasure detects all possible attacks.

References

1. Nicholas Carlini, Pratyush Mishra, Tavish Vaidya, Yuankai Zhang, Micah Sherr, Clay Shields, David Wagner, and Wenchao Zhou. 2016. Hidden Voice Commands.. In USENIX Security Symposium. 513--530.
2. Ruchir Chauhan. 2014. A platform for false data injection in frequency modulated continuous wave radar. Utah State University.
3. Drew Davidson, Hao Wu, Robert Jellinek, Vikas Singh, and Thomas Ristenpart. 2016. Controlling UAVs with Sensor Input Spoofing Attacks. WOOT.
4. Peter D Hanlon and Peter S Maybeck. 2000. Multiple-model adaptive estimation using a residual correlation Kalman filter bank. IEEE Trans. Aerospace Electron. Systems Vol. 36, 2 (2000), 393--406.
5. Andrew J Kerns, Daniel P Shepard, Jahshan A Bhatti, and Todd E Humphreys. 2014. Unmanned aircraft capture and control via GPS spoofing. Journal of Field Robotics Vol. 31, 4 (2014), 617--636.
6. Denis Foo Kune, John Backes, Shane S Clark, Daniel Kramer, Matthew Reynolds, Kevin Fu, Yongdae Kim, and Wenyuan Xu. 2013. Ghost talk: Mitigating EMI signal injection attacks against analog sensors Security and Privacy (SP), 2013 IEEE Symposium on. IEEE, 145--159.
7. Hyung-Jik Lee and Seul Jung. 2009. Gyro sensor drift compensation by Kalman filter to control a mobile inverted pendulum robot system. In Industrial Technology, 2009. ICIT 2009. IEEE International Conference on. IEEE, 1--6.
8. Wei Li and Jinling Wang. 2013. Effective adaptive Kalman filter for MEMS-IMU/magnetometers integrated attitude and heading reference systems. The Journal of Navigation Vol. 66, 1 (2013), 99--113.
9. Faraz M Mirzaei and Stergios I Roumeliotis. 2008. A Kalman filter-based algorithm for IMU-camera calibration: Observability analysis and performance evaluation. IEEE transactions on robotics Vol. 24, 5 (2008), 1143--1156.
10. Yilin Mo and Bruno Sinopoli. 2010. False Data Injection Attacks in Control Systems. In First Workshop on Secure Control Systems.
11. Young-Seok Park, Yunmok Son, Hocheol Shin, Dohyun Kim, and Yongdae Kim. 2016. This Ain't Your Dose: Sensor Spoofing Attack on Medical Infusion Pump. WOOT.
12. Aanjhan Ranganathan, Boris Danev, Aurélien Francillon, and Srdjan Capkun. 2012. Physical-layer attacks on chirp-based ranging systems Proceedings of the fifth ACM conference on Security and Privacy in Wireless and Mobile Networks. ACM, 15--26.
13. Daniel Roetenberg, Henk Luinge, and Peter Veltink. 2003. Inertial and magnetic sensing of human movement near ferromagnetic materials Mixed and Augmented Reality, 2003. Proceedings. The Second IEEE and ACM International Symposium on. IEEE, 268--269.
14. Daniel Roetenberg, Henk J Luinge, Chris TM Baten, and Peter H Veltink. 2005. Compensation of magnetic disturbances improves inertial and magnetic sensing of human body segment orientation. IEEE Transactions on neural systems and rehabilitation engineering Vol. 13, 3 (2005), 395--405.
15. Daniel Roetenberg, Per J Slycke, and Peter H Veltink. 2007. Ambulatory position and orientation tracking fusing magnetic and inertial sensing. IEEE Transactions on Biomedical Engineering Vol. 54, 5 (2007), 883--890.
16. Stergios I Roumeliotis, Gaurav S Sukhatme, and George A Bekey. 1999. Circumventing dynamic modeling: Evaluation of the error-state kalman filter applied to mobile robot localization. In Robotics and Automation, 1999. Proceedings. 1999 IEEE International Conference on, Vol. Vol. 2. IEEE, 1656--1663.
17. Angelo M Sabatini. 2006. Quaternion-based extended Kalman filter for determining orientation by inertial and magnetic sensing. IEEE Transactions on Biomedical Engineering Vol. 53, 7 (2006), 1346--1356.
18. NXP Semiconductors. 2016 a. AN5023 - Sensor Fusion Kalman Filters.
19. NXP Semiconductors. 2016 b. IoT Sensing Software Development Kit: Embedded Software Framework. (2016). https://www.nxp.com/support/developer-resources/software-development-tools/sensor-developer-resources/sensor-toolbox-sensor-development-ecosystem/iot-sensing-software-development-kit-embedded-software-framework:IOT-SENSING-SDK Retrieved December 15, 2017 from tempurl
20. NXP Semiconductors. 2016 c. Sensor Toolbox Development Platform for FXAS21002C and FXOS8700C 9-Axis Solution. (2016). http://www.nxp.com/products/developer-resources/hardware-development-tools/freedom-development-boards/sensor-toolbox-development-platform-for-fxas21002c-and-fxos8700c-9-axis-solution:FRDM-STBC-AGM01 Retrieved December 15, 2017 from tempurl
21. Yasser Shoukry, Paul Martin, Paulo Tabuada, and Mani Srivastava. 2013. Non-invasive spoofing attacks for anti-lock braking systems International Workshop on Cryptographic Hardware and Embedded Systems. Springer, 55--72.
22. Yunmok Son, Hocheol Shin, Dongkwan Kim, Young-Seok Park, Juhwan Noh, Kibum Choi, Jungwoo Choi, Yongdae Kim, et almbox.. 2015. Rocking Drones with Intentional Sound Noise on Gyroscopic Sensors. USENIX Security Symposium. 881--896.
23. Ciza Thomas (Ed.).. 2011. Sensor Fusion - Foundation and Applications. InTech.
24. Timothy Trippel, Ofir Weisse, Wenyuan Xu, Peter Honeyman, and Kevin Fu. 2017. WALNUT: Waging doubt on the integrity of mems accelerometers with acoustic injection attacks. In Security and Privacy (EuroS&P), 2017 IEEE European Symposium on. IEEE, 3--18.
25. Zhengbo Wang, Kang Wang, Bo Yang, Shangyuan Li, and Aimin Pan. 2017. Sonic Gun to Smart Devices - Your Devices Lose Control Under Ultrasound/Sound BlackHat USA.
26. Chen Yan, Wenyuan Xu, and Jianhao Liu. 2016. Can you trust autonomous vehicles: Contactless attacks against sensors of self-driving vehicle. DEF CON Vol. 24 (2016).
27. Xiaoping Yun and Eric R Bachmann. 2006. Design, implementation, and experimental results of a quaternion-based Kalman filter for human body motion tracking. IEEE transactions on Robotics Vol. 22, 6 (2006), 1216--1227.
28. Guoming Zhang, Chen Yan, Xiaoyu Ji, Taimin Zhang, Tianchen Zhang, and Wenyuan Xu. 2017. Dolphinatack: Inaudible voice commands. arXiv preprint arXiv:1708.09537 (2017).
29. Rui Zhang and Leonhard M Reindl. 2011. Pedestrian motion based inertial sensor fusion by a modified complementary separate-bias Kalman filter. In Sensors Applications Symposium (SAS), 2011 IEEE. IEEE, 209--213.

Index Terms

• Security and privacy

  • Security in hardware

    • Hardware attacks and countermeasures