sensors Article

A Smart Sensor for Defending against Clock Glitching Attacks on the I2C Protocol in Robotic Applications Raúl Jiménez-Naharro, Fernando Gómez-Bravo *, Jonathan Medina-García, Manuel Sánchez-Raya and Juan Antonio Gómez-Galán Department of Electronic Engineering, Computers, and Automation, University of Huelva, Ctra Huelva-La Rábida, s/n, 21819 Huelva, Spain; [email protected] (R.J.-N.); [email protected] (J.M.-G.); [email protected] (M.S.-R.); [email protected] (J.A.G.-G.) * Correspondence: [email protected]; Tel.: +34-959-217-638; Fax: +34-959-217-348 Academic Editor: Gonzalo Pajares Martinsanz Received: 26 January 2017; Accepted: 17 March 2017; Published: 25 March 2017

Abstract: This paper presents a study about hardware attacking and clock signal vulnerability. It considers a particular type of attack on the clock signal in the I2C protocol, and proposes the design of a new sensor for detecting and defending against this type of perturbation. The analysis of the attack and the defense is validated by means of a configurable experimental platform that emulates a differential drive robot. A set of experimental results confirm the interest of the studied vulnerabilities and the efficiency of the proposed sensor in defending against this type of situation. Keywords: smart sensor for robots; hardware vulnerability; mobile robot attack; clock signal defense

1. Introduction Over the last recent years, the study of vulnerability in electronic devices has attracted the attention of the scientific community [1–4]. Among electronics systems, robotic platforms are one of the most widely used today. Currently, robots are responsible for executing many critical tasks such as rescue, surveillance, industrial processes, and different operations in general day life [5–8]. Robot control is traditionally implemented by a computer-based architecture, so the study of security issues regarding computer vulnerability represents a relevant matter to develop secure robots. Security analysis involves the study of the effects of voluntary actions with the aim of violating or modifying the system behaviour. These types of actions are usually known as attacks, and the weakness exploited by the attacker is known as a vulnerability. Moreover, not only it is important to detect vulnerabilities, but also to define mechanisms for a feasible defense. Some strategies have been developed for defending computed systems. On the one hand, masking the transmitted information in order to preserve communication privacy can be a defense objective; several methodologies have been applied for this purpose, like for instance the use of encryption algorithms [9] or synchronized chaotic systems [10]. On the other hand, another strategy is to develop a device to detect the attack and avoid the intentions of the attackers [1,2]. This paper deals with the study of a specific vulnerability that affects mobile robots and presents the design of a sensor for defending against this particular type of attack. Many different works have addressed the study of vulnerability of computer-based systems from the point of view of software [11,12] and hardware [1–3,13]. The attacks that exploit the hardware vulnerabilities are known as hardware attacks. Although reliability and fault tolerance of robots are open issues recently discussed by the scientific community [14,15], the vulnerability of robotic systems has not been frequently considered. Hardware and software attacks directly decrease robots’ reliability. Sensors 2017, 17, 677; doi:10.3390/s17040677

www.mdpi.com/journal/sensors

Sensors 2017, 17, 677

2 of 17

The study of the effect of software attacks can be easily extended to a robotic platform. However, the effects of hardware attacks should be particularly considered, by taking into account the specific sensors and actuators applied in the robotics field [16,17]. An important question regarding this matter is the communication between the control system and the peripherals. In this context, the Inter-Integrated Circuit (I2C) protocol is a commonly used mechanism to establish this communication process. In fact, the use of I2C low level controllers in mobile robotics has spread in the last years. I2C is a synchronous protocol, where the clock signal plays a relevant role. Clock synchronization heavily depends on the applied synchronization protocol and algorithm; a detailed overview of the state of the art about this matter can be found in [18–20]. This paper aims to discuss the possibility of attacking a robotic system by interfering with the clock signal of the I2C protocol and proposes a defense strategy for this attack. Though this work is focused on the I2C protocol, other different types of protocols can also be objectives of clock attacking. In fact, the strategy presented in this work is based on detecting anomalies in the clock frequency. Therefore, this solution is suitable for defending any protocol vulnerable to an attack that injects frequency variations in the clock signal, as for instance: CAN-bus, SPI protocol, etc. The case study presented in this work is related with autonomous mobile robot navigation. Namely, it is supposed that the robot navigates by applying a path tracking algorithm, so that it is capable of visiting certain areas of interest defined by the user. Typical mobile robotics applications use this type of navigation strategy [5,6,21,22]. In this context the paper studies the possibility of attacking the communication process between the high level controller and low level controller using the I2C protocol, and evaluates the efficiency of the proposed defending device. The paper is organized as follows: Section 2 is devoted to presenting the basis of clock attacking and to explain vulnerabilities of the I2C protocol. Section 3 shows details about the proposed countermeasure strategy. Section 4 introduces the case study and describes the experimental platform. In Section 5 several experimental results that validate the authors’ hypothesis are shown. Finally, some conclusions are drawn in Section 6. 2. The Clock Signal: A Possible Source of Attacks The main objective of many attacks is the interference with the clock signal due to its importance in the system operation. More particularly, the perturbation may consist in modifying the frequency or the period of the clock signal. In Figure 1, several attacks using clock signals are shown. In this figure, signal nominal clk is the clock signal free of attack (with the correct period), and signal attack clk is the clock signal with attack (with the altered period). In Figure 1a, an attack increasing the clock period is shown. The outcome of this attack is a decrease in the operation speed. This interference can be used, for instance, to monitor the main signals (using the monitoring clock signal) for applying reverse engineering [23]. In Figure 1b, an attack decreasing the clock period is shown. The decrement must be lower than the minimum period to guarantee the correct operation (as seen from its minimum period). The effect of this attack is a global malfunction of the system that can be used, as an example, to cause a denial of service. In Figure 1c, an attack decreasing the clock period, focused on a certain operation, is shown. In this case, the effect of the attack consists in avoiding a certain operation (as seen from the delay of this operation). This attack is usually known as a clock glitching attack. This last attack can be used, for instance, against cryptocircuits implementing an encryption algorithm. The aim of the attack is to avoid the complete cycle of the encryption causing a vulnerability in the circuit. This fact can be achieved independently on the implementation platform (processor, ASIC, FPGA, . . . ) because all of them require a clock signal. This situation is discussed in [24].

Sensors 2017, 17, 677 Sensors 2017, 17, 677

3 of 17 3 of 17

Figure 1. 1. Examples Examples of of attack attack using using clock clock signal. signal. (a) (a) Attack Attack increasing increasing the the clock clock period; period; (b) (b) attack attack Figure decreasing the clock period; (c) attack to a certain instruction: clock glitching attack. decreasing the clock period; (c) attack to a certain instruction: clock glitching attack.

Attack on on the the Protocol Protocol I2C 2.1. Attack I2C vulnerability vulnerability has has not not been beenfrequently frequentlyaddressed addressed[25,26]. [25,26].This This protocol is widely used I2C protocol is widely used in in robotics platforms to connect the controllers actuating elements like motors and sensors. robotics platforms to connect the controllers withwith actuating elements like motors and sensors. This This section is devoted to the study of clock glitching attacks theI2C I2Cprotocol. protocol.They Theyare are easy easy to section is devoted to the study of clock glitching attacks in in the study the the implement, and very difficult to detect (this fact increases the danger), so it is important to study effect and the solutions to this threat in a so frequently used protocol. This protocol protocol uses uses two two different signals: signals: aa scl scl signal signal that that has has the the synchronization synchronization information; information; This sda signal signal that that has has the the data data information. information. The The communication communication process process involves involves the the transmission transmission and aa sda of three different types of data: slave slave address, address, with with aa maximum maximum of of 128 128 slaves slaves (or (or 1024 1024 slaves slaves in in the the of extended version); version); register register address, address, indicating indicating the the register register to interact; interact; and register value, indicating indicating extended the transmitted value. One One of of the the main main characteristics characteristics of of this protocol is the signaling: the the high high logic the level is is in a situation of high impedance; impedance; and and the the low low logic logic level level is is the the reference reference voltage. voltage. Therefore, Therefore, level the communication communication involves involves the the connection connection of of ground ground to to scl scl and and sda sda signals signals in in the the low logic level the case. Due Due to to the the high high impedance, impedance, both both master master and and slave slave can can write write in scl and sda signals. Also, Also, the case. high impedance is a source of attack because any element can access and write on sda and scl signals without causing any conflict. As an anexample exampleofofthe thebehavior behavior protocol, Figure 2a shows a write operation (the As of of thethe I2CI2C protocol, Figure 2a shows a write operation (the black blackidentifies color identifies theisvalue is written by a and master, color identifies that is the value color that thethat value written by a master, blueand colorblue identifies that the value written is written by This a slave). This operation as follows. Firstly, the communication idle by a slave). operation works asworks follows. Firstly, the communication begins begins in idleinstate state (identified and sda signals thelevel). high level). The communication is controlled by the (identified by scl by andsclsda signals to the to high The communication is controlled by the master master and starts withcondition a start condition (identified by transition a falling transition the sda signal the and starts with a start (identified by a falling in the sdain signal while the while scl signal sclhigh). signalNext, is high). Next, the slave to communicate is sent (A6:A0 signals). After that, is the address ofaddress the slaveoftothe communicate is sent (A6:A0 signals). After that, RW signal RWsent signal sent (the write operation is identified by alevel low signal). level signal). Following, the slave sends is (theis write operation is identified by a low Following, the slave sends an an acknowledgement (identified a low in the sda signal in the scl pulse) indicating acknowledgement (identified by aby low levellevel in the sda signal in the 8th 8th scl pulse) indicating thatthat the the slave acknowledged its participation in communication the communication process. to send slave has has acknowledged its participation in the process. The The nextnext stepstep is toissend the the register address of slave the slave in which the master will write the transmitted (R7:R0 signals), register address of the in which the master will write the transmitted valuevalue (R7:R0 signals), and andslave the slave sends the acknowledgement in17th the 17th pulse ofscl thesignal. scl signal. Finally, the master sends the sends the acknowledgement in the pulse of the Finally, the master sends the the value written register theslave, slave,and andthe theslave slave acknowledges acknowledges the the writing writing value thatthat willwill be be written in in thethe register ofofthe pulse of the The communication processprocess finishesfinishes with a stop condition operation (in (inthe the26th 26th pulse of scl thesignal). scl signal). The communication with a stop (identified(identified by a risingby transition the sda signal the scl while signal the is atscl a high level recovering the condition a risingintransition in thewhile sda signal signal is at a high level idle state). the idle state). recovering The characteristics of this protocol allow to perform focused attacks, i.e., to attack the communication with a particular slave or the communication with a certain register of a specific slave. In this paper, the attacks involve the variation of the period in the scl signal of the protocol. An

Sensors 2017, 17, 677

4 of 17

example is shown in Figure 2b. This figure illustrates an attack in the communication process of a certain slave (the black color identifies the value written by the master, and the red color identifies the value written by the attacker). In this process, three modules are involved: a master, a slave and Sensors 2017, 17, 677 4 of 17 the attack module.

Figure 2. 2. Behavior Behavior of of I2C I2C protocol. protocol. (a) (a) Write Write operation; Figure operation; (b) (b) attacked attacked write write operation. operation.

The communication process begins normally, is, in the start state with the of characteristics of this protocol allow tothat perform focused attacks, i.e.,transmission to attack the the slave address. Tilla this moment, theor behavior of the attack with module consists in monitoring the communication with particular slave the communication a certain register of a specific communication in order to decide when performofthe depending on the transmitted slave. In this paper, the attacks involve the to variation the attack, period in the scl signal of the protocol. address. If the attack in must begin, is flattened, i.e., is communication forced to keep aprocess low value An example is shown Figure 2b. the Thisclock figuresignal illustrates an attack in itthe of a during slave the communication Then, the attack module a low levelred in color the scl signal, and certain (the black colorprocess. identifies the value written by thewrites master, and the identifies the as a consequence, noattacker). sda signalInvalue will be three seen by any slave module, thus, the message willthe be value written by the this process, modules are involved: a master, a slave and lost. Before that, the attack module generates an acknowledgement signal so that the master does not attack module. identify anomalous situation. Thean communication process begins normally, that is, in the start state with the transmission of the slave address. Till this moment, the behavior of the attack module consists in monitoring the 3. Countermeasures communication in order to decide when to perform the attack, depending on the transmitted address. If theIfattack must begin, theofclock signal is is flattened, it isattacked, forced toa keep a low valuemust during a system responsible a critical task at risk ofi.e., being defense strategy be the communication process. Then, the attack module writes a low level in the scl signal, and as a included in the system design. The main purpose of this strategy should consist in thwarting the consequence, no sda signal value will be seen by any slave module, thus, the message will be lost. objectives of the attacker. When a vulnerability source is the clock signal, any defense strategy Before the aattack module generates an to acknowledgement signal so values. that theInmaster does not should that, include frequency sensor in order detect anomalous period this approach, identify an anomalous situation. clock glitching attacks are detected by means of this type of sensor. A particular implementation of a digital frequency sensor is cited in [27]. As mentioned in that paper, the standard detection solutions 3. Countermeasures are usually based on analog filters, such as the one included in [28]. The comparison between that If a system of a frequency critical tasksensor is at risk being a defense strategy must be solution and theresponsible use of a digital has of been alsoattacked, presented in [27]. That result is not included inthe themodifications system design. The main purpose of thisinstrategy consist in thwarting the affected by implemented on the sensor this newshould application. objectives of thethe attacker. vulnerabilityby source the clock signal, defense strategy shoulda Although sensor When can beamaterialized usingisVLSI [27] or FPGAany techniques, in this paper include a frequency sensor in order detect anomalous values. In this approach, clockThe glitching FPGA implementation has been to considered so thatperiod a rapid prototype is achieved. basic attacks are detected means this type of sensor. particular a digital architecture of this by sensor is of shown in Figure 3a.AThe sensor implementation consists of fourofblocks: a frequency transition sensor is cited in [27]. As mentioned in that paper, standardand detection solutions are usually of based detector, to detect a new transition during signal the monitoring to begin the measurement the on analog filters, as thetoone included [28]. The comparison between thatblock, solution and the frequency; a local such oscillator, avoid similarin attacks on the sensor; a measurement to measure use of a digitalasfrequency hasoscillator; been alsoand presented in [27]. That result is the not response affected by the frequency pulses of sensor the local an output block, to generate of the modifications implemented the sensor in this newthe application. sensor. The response of thison sensor is to regenerate clock signal when its frequency is out of the Although sensor can be materialized by using VLSIin [27] orisFPGA in thisshown paperin a allowed range.the Though the concept of the sensor presented [27] valid techniques, for the situation FPGA implementation has been considered so that a rapid prototype is achieved. The basic architecture Figure 2 (the attack to the I2C protocol), its implementation is not valid for different reasons: of this sensor is shown in Figure 3a. The sensor consists of four blocks: a transition detector, to detect  The idle state of the protocol (with a frequency equal to zero) would be identified as an attack. a new transition during signal monitoring and to begin the measurement of the frequency; a local  The low frequency of some slaves requires excessive hardware resources in the implementation oscillator, to avoid similar attacks on the sensor; a measurement block, to measure the frequency as of the local oscillator. pulses of the local oscillator; and an output block, to generate the response of the sensor. The response  The response of the sensor is the same than the objective of attack, that is, to flatten the scl of this sensor is to regenerate the clock signal when its frequency is out of the allowed range. Though signal. Therefore, a new response must be generated. the concept of the sensor presented in [27] is valid for the situation shown in Figure 2 (the attack to the I2C protocol), its implementation is not valid for different reasons:

Sensors 2017, 17, 677

5 of 17

Then a new implementation for the detector of transition, the local oscillator, and the output 5 of 17 blocks must be done.

Sensors 2017, 17, 677

• The idle state of the protocol (with a frequency equal to zero) would be identified as an attack. • The low frequency of some slaves requires excessive hardware resources in the implementation of Sensors 2017, 17, 677 5 of 17 the local oscillator. • The of the sensor is the than theof objective of attack, thatoscillator, is, to flatten the scloutput signal. Thenresponse a new implementation forsame the detector transition, the local and the Therefore, new response must be generated. blocks must be adone.

Figure 3. Architecture of the frequency sensor as countermeasure against an attack based on clock signal. (a) Basic architecture in [27]; (b) New architecture adapted to I2C protocol.

3.1. Transition Detector The main function of the transition detector is to identify the beginning of a new operation, a transition of the scl signal. However, while in the early implementation, the reset signals are only activeFigure due 3. to Architecture the transition (seefrequency Figure 4); the as actual implementation a reset of the sensor againstmaintains an attack based on condition clock countermeasure signal. (a) Basic architecture in [27]; (b) New architecture adapted to I2C protocol. during the idle state in the transmission, and architecture so, the idleadapted state is to notI2C considered protocol. as an attack. The behavior of the transition detector is shown in Figure 4. During the idle state of the 3.1. Transition Detector protocol, sensor waits for a new communication process the resetting the local and oscillator. This Thenthe a new implementation for the detector of transition, local oscillator, the output waiting finishes when aof start moment, the reset cycle completed and aa blocks must be function done. The main the condition transitionarrives. detectorInisthis to identify the beginning of is a new operation, new measurement begins. Following, all scl signal pulses are measured by the sensor until the transition of the scl signal. However, while in the early implementation, the reset signals are only 3.1. Transition Detector arrival of a stop condition or the detection of an attack. In the case of a detected attack, the sensor active due to the transition (see Figure 4); the actual implementation maintains a reset condition would activate its response (busy signal is activated). During response, the transition detector is The main of transmission, the transition detector to identify the beginning ofan a new operation, during the idle function state in the and so, theisidle state the is not considered as attack. disabled until the response has finished (busy signal is deactivated) and the current communication a transition of the scl However, while inisthe early in implementation, the reset signals The behavior ofsignal. the transition detector shown Figure 4. During the idle stateare ofonly the process finishes (the arrival of a stop condition). Following that, the local oscillator is reset until a active due to the transition (see Figure 4); the actual implementation maintains a reset condition during protocol, the sensor waits for a new communication process resetting the local oscillator. This new start condition arrives. the idle state in the transmission, and so,arrives. the idle In state not considered as an attack. waiting finishes when a start condition thisismoment, the reset cycle is completed and a new measurement begins. Following, all scl signal pulses are measured by the sensor until the arrival of a stop condition or the detection of an attack. In the case of a detected attack, the sensor would activate its response (busy signal is activated). During the response, the transition detector is disabled until the response has finished (busy signal is deactivated) and the current communication process finishes (the arrival of a stop condition). Following that, the local oscillator is reset until a new start condition arrives.

Figure 4. 4. Behavior Behavior of of the the transition transition detector. detector. The The following following cases cases are are considered: considered: aa start start condition; condition; a a Figure detected attack; attack; aa stop stop condition; condition; and and aa new new start start condition. condition. detected

The early behavior is implemented asynchronously because the clock signal is flattened during The behavior of the transition detector is shown in Figure 4. During the idle state of the protocol, its operation. The implementation of the transition detector consists of three sections, shown in the sensor waits for a new communication process resetting the local oscillator. This waiting finishes Figure 5. Firstly, there is a reset circuitry whose main function is the initialization of the block. This when a start condition arrives. In this moment, the reset cycle is completed and a new measurement section identifies the arrival of a new event in the scl signal and the start and stop conditions. begins. Following, all scl signal pulsesdetector. are measured by the sensor until the arrival of acondition; stop condition Figure 4. Behavior of the transition The following cases are considered: a start a Secondly, a chain of delay elements whose main function consists in generating the adequate delays. or thedetected detection of an attack. In theand case of a start detected attack, the sensor would activate its response attack; a stop condition; a new condition. Thirdly, a section to generate the initialization of the rest of sensor blocks with the adequate (busy signal is activated). During the response, the transition detector is disabled until the response sequence. The early behavior asynchronously because the clock signal is flattened during has finished (busy signal is implemented deactivated) and the current communication process finishes (the arrival of operation. TheFollowing implementation the oscillator transitionisdetector consists of three sections, shown in aitsstop condition). that, theoflocal reset until a new start condition arrives. Figure 5. Firstly, there is a reset circuitry whose main function is the initialization of the block. This section identifies the arrival of a new event in the scl signal and the start and stop conditions. Secondly, a chain of delay elements whose main function consists in generating the adequate delays. Thirdly, a section to generate the initialization of the rest of sensor blocks with the adequate sequence.

Sensors 2017, 17, 677 Sensors 2017, 17, 677

6 of 17 6 of 17

It is early worth mentioning that the chain of delay must guarantee thatsignal the sequence ofduring the reset The behavior is implemented asynchronously because the clock is flattened its signals of the blocks is of correct. This sequence is detailed in three [27], and a short description is as operation. Thedifferent implementation the transition detector consists of sections, shown in Figure 5. follows: first isthe oscillator is reset, thefunction output isblock is reset andofactivated, the Firstly, there a reset circuitry whosethen main the initialization the block.after Thisthat section measurement block of is areset and finally, oscillator activated. Secondly, In this case, the identifies the arrival new and eventactivated, in the scl signal and thethe start and stopisconditions. a chain sequence requires whose ten delay elements. mainin component theadequate delay element a buffera(shown of delay elements main functionThe consists generatingofthe delays.isThirdly, section in 5),the which is implemented by using a transparent latch. to Figure generate initialization of the rest of sensor blocks with the adequate sequence.

Figure 5. Schematic of the transition detector, identifying the three main sections: sections: (a) (a) reset reset circuitry; circuitry; (b) the chain of delay elements; and and (c) (c) the initialization initialization of of the the sensor sensor blocks blocks (local (local oscillator, oscillator, measurement block and output block).

3.2. Local Oscillator It is worth mentioning that the chain of delay must guarantee that the sequence of the reset signals of theThough different blocks is correct. sequence is detailed [27], and a shortthe description is as follows: the function of thisThis block is independent oninthe application, use of low frequency first the oscillator is reset, then the output block is reset and activated, after that the measurement can require an excessive number of resources (basically flip-flops). A comparison in hardware block is reset and activated, andlimit finally, the oscillator is activated. In this sequence resources considering an upper of frequency of 12.5 kHz is shown incase, Tablethe 1. This table requires shows a ten delay elements. main component of the element is ainbuffer (shown in Figure 5), which is comparative study The concerning the number of delay flip-flops used different implementations of the implemented by using a transparent latch. sensor. The differences are due to the different implementations of the local oscillator generating different periods. 3.2. Local The Oscillator total number of flip-flops is determined by the sum of the number of flip-flops in the following building blocks:ofthe local oscillator, the transition the the measurement block and can the Though the function this block is independent on the detector, application, use of low frequency output block. In the case of the local oscillator, this number is equal to the relation between its period require an excessive number of resources (basically flip-flops). A comparison in hardware resources and the delay one element. In the case of the transition number is fixeda and equal to considering anof upper limit of frequency of 12.5 kHz is showndetector, in Table the 1. This table shows comparative 8. In the case of thethe measurement the number equal toimplementations the relation between thesensor. upper limit study concerning number of block, flip-flops used in is different of the The of the allowed period and the oscillator period. In the case of the output block, the number is equal differences are due to the different implementations of the local oscillator generating different periods. to theThe half of the flip-flops of the measurement block thethe necessary elements toin implement the total number of flip-flops is determined by the plus sum of number of flip-flops the following I2C orderblocks: (that is the fixed). building local oscillator, the transition detector, the measurement block and the output Table 1 case shows thatlocal the oscillator, implementation with is a equal minimum flip-flops involves a block. In the of the this number to thenumber relationof between its period and trade-off a low and a high in the detector, local oscillator. As aisconsequence of these the delay between of one element. In the case frequency of the transition the number fixed and equal to 8. reasoning, two alternatives can be used: a high frequency local oscillator, with a high number In the case of the measurement block, the number is equal to the relation between the upper limit of flip-flops inperiod the measurement and output or aoflow local the allowed and the oscillator period. blocks; In the case the frequency output block, theoscillator, number iswith equalatohigh the number flip-flops local oscillator. However, the optimal solution involvesthe a I2C trade-off half of theofflip-flops of in thethe measurement block plus the necessary elements to implement order between a low and a high frequency in the local oscillator. (that is fixed).

Sensors 2017, 17, 677

7 of 17

Table 1. Study of the flip-flop numbers varying the period oscillator considering a delay element of 1.91 ns. The upper limit of period is 80 µs (12.5 kHz). Flip-Flops Oscillator Sensors 2017, 17, 677 Period

Oscillator

Detector

Measurement

Output

Total FF

7 of 17

4 ns of the flip-flop 3numbers varying 8 the period20,000 10,000 a delay 30,003 Table 1. Study oscillator considering element of 40 ns 21 8 2000 1000 3021 1.91 ns. The upper limit of period is 80 s (12.5 kHz). 90 ns 48 8 889 445 1390 200 ns 105 8 Flip-Flops 400 200 713 Oscillator400 Period ns 210 8 200 100 518Total FF Oscillator Detector Measurement Output 900 ns 472 8 89 45 614 4 ns 3 8 20,000 10,000 30,003 4 µs 2095 8 20 10 2133 40 ns 21 8 2000 1000 3021 90 ns 48 8 889 445 1390 ns 105 8 200 involves a 713 Table200 1 shows that the implementation with a minimum400 number of flip-flops trade-off 400 ns 210 8 200 100 518 between a low and a high frequency in the local oscillator. As a consequence of these reasoning, two 900 ns 472 frequency 8local oscillator, 89 45 of flip-flops 614in the alternatives can be used: a high with a high number 2095 8 20 10 2133 4 s

measurement and output blocks; or a low frequency local oscillator, with a high number of flip-flops in the local oscillator. However, the optimal solution involves a trade-off between a low and a high Though it is possible to find an optimal configuration, the minimum number of flip-flops is frequency in the local oscillator. considerable. A new implementation is going to be designed in order to reduce the hardware Though it is possible to find an optimal configuration, the minimum number of flip-flops is resources. This new solution consists of two different strategies: a ring oscillator and a binary considerable. A new implementation is going to be designed in order to reduce the hardware resources. counter as frequency divider; as shown in Figure 6. The ring oscillator will generate a precision This new solution consists of two different strategies: a ring oscillator and a binary counter as frequency period, while the frequency divider will multiply the period without necessity of many hardware divider; as shown in Figure 6. The ring oscillator will generate a precision period, while the frequency resources. Therefore, the new implementation will use two configuration parameters: the number of divider will multiply the period without necessity of many hardware resources. Therefore, the new delay element in the ring oscillator (num_delay), and the number of the flip-flops in the divider implementation will use two configuration parameters: the number of delay element in the ring (num_multiply). oscillator (num_delay), and the number of the flip-flops in the divider (num_multiply).

Figure of of thethe local oscillator based on a ring and a frequency divider. Figure 6.6.New Newimplementation implementation local oscillator based on aoscillator ring oscillator and a frequency divider.

The following step will be to compare the two implementations. This comparison is shown in following step will to compare the two implementations. Thisnumber comparison is shown in TableThe 2, where delayelement is thebedelay of one delay element, num_delay is the of delay elements Table 2, where delay element is the of delay of one element, num_delay the oscillator number of delay and num_multiply is the number counter bits. delay Therefore, the period of theislocal and the elementsofand num_multiply is the numberare of counter bits. number flip-flops in the local oscillator shown in (1):Therefore, the period of the local oscillator and the number of flip-flops in the local oscillator are shown in (1): period of local oscillator = [(delayelement + delayrouting ) * num_delay] * 2num_multiply , (1) period of local oscillator = [(delayelement + delayrouting) * num_delay] * 2num_multiply, number of flip-flops = num_delay + num_multiply, (1) number of flip-flops = num_delay + num_multiply, The period of of thethe local oscillator depends on the of theofring The first firstequation equationindicates indicatesthat thatthe the period local oscillator depends on period the period the oscillator (expression betweenbetween the brackets) multipliedmultiplied by the frequency factor divider (expression at ring oscillator (expression the brackets) by thedivider frequency factor

(expression at the right of the brackets). Also, the number of flip flops depends on the number of elements needed for the implementation of both the ring oscillator and the frequency divider. Table 2 shows a study of the optimal configuration of the oscillator (using a ring configuration determined by num_delay and a frequency divider determined by num_multiply). Three configurations for a same nominal period are considered: minimizing num_delay; minimizing num_multiply; minimizing the sum of num_delay and num_multipy. Due to the quantization of the

Sensors 2017, 17, 677

8 of 17

the right of the brackets). Also, the number of flip flops depends on the number of elements needed for the implementation of both the ring oscillator and the frequency divider. Table 2 shows a study of the optimal configuration of the oscillator (using a ring configuration determined by num_delay and a frequency divider determined by num_multiply). Three configurations for a same nominal period are considered: minimizing num_delay; minimizing num_multiply; minimizing the sum of num_delay and num_multipy. Due to the quantization of the period with the delay elements, the period obtained cannot be equal to the nominal period, and hence there will be an error between the nominal and the obtained period. The optimal configuration will be a trade-off between hardware resources (sum of num_delay and num_multiply) and error, that is, the third configuration: minimizing the sum of parameters. Table 2. Study of the flip-flop numbers varying the period oscillator considering a delayelement of 1.91 ns. The upper limit of period is 80 µs (12.5 kHz). Ring-Divisor Oscillator

Ring Oscillator

Period (ns)

Error Period (%)

num_delay

Period (ns)

Error Period (%)

1

3.82

4.5%

2

3.82

4.5%

105 1 3

1 8 6

401.1 489.0 366.7

0.3% 22% 8.3%

210

401.1

0.3%

1048 1 4

1 12 9

4003 7823 3912

0.07% 96% 2.2%

2095

4001.5

0.04%

Nom. Period (ns)

num_delay

4

1

400

4000

num_multiply

3.3. Output Block The main function of the output block is to generate the response of the sensor, which has to be particularly defined in each application. In this case, the response is going to be divided into two different actions. Firstly, when no attack is detected, the response of the sensor will be to allow the passage of the protocol signals (sda and scl signals). On the other hand, when an attack is detected, the response of the sensor will be to disconnect the slave from the sda and scl attacked channel and to induce a certain defense behavior in the slave in order to avoid the possible objectives of the attacker. A block scheme of the output block is shown in Figure 7. There, the two different actions can be identified. The selection between both actions comes from the measurement block that identifies the arrival of an attack. Firstly, the pass of the protocol signals is identified by the direct connection to the multiplex units. This direct pass avoids possible desynchronizations between both the scl and sda signals. In the second case, depending on the location of the sensor, the attack response can be different. On the one hand, if the sensor is on the same substrate (and hence in the same security region), the sensor will have direct access to the register included in the I2C transmission. Therefore, it will be able to write directly a certain value in the register in order to induce the defense behavior. On the other hand, if the sensor is in the same security region but on a different substrate, it does not have direct access to the register. Therefore, the response of the sensor will be sending a secure clock signal and a specific sequence of I2C messages in a particular order, so that the defense behavior is initiated. In this case, the sensor will supplant the master functions. In this paper, the second option is applied. In Figure 7, this strategy is implemented in two different blocks. Firstly, the sensor must regenerate the scl signal from the master to maintain the same timing as in the rest of transactions. This regeneration is done in the scl regenerator element. This element is similar to the element in the sensor referenced in [27], and it needs information from the local oscillator (the period of the local clock signal), the transition detector (to initiate its operation) and the measurement block (the period of the original scl signal and the signal to start the sensor order). Once the scl signal is regenerated, the sda signal is generated to send the defense order by the response order element. This order can represent one or several I2C transactions (because it may be necessary to write in several registers of the slave).

Sensors 2017, 17, 677

9 of 17

The transactions must include the address of the slave, the address of the registers and the value to write in the registers. The behavior of this element is fixed, and hence, the only information that it Sensors 2017, 17, from 677 the measurement block (the signal to initiate the transaction). of 17 17 Sensors 17, 677 99 of needs 2017, comes

Figure 7. 7. New New implementation implementation of of the the output output block block based based on on the the multiplexing multiplexing of of the the bus bus signals. signals. Figure

Sensor Simulations 3.4. Sensor elementsdescribed describedabove above have been implemented in a FPGA a model. VHDL The elements have been implemented in a FPGA devicedevice using ausing VHDL The use The of a use ringofoscillator involves involves that the clock period depends the delay of the ring, model. a ring oscillator that the clock period on depends on the delay of and the hence, it is necessary a post-routed simulation to consider the delay of the implementation. The ring, and hence, it is necessary a post-routed simulation to consider the delay of the implementation. The implementation requires theofuse of a determined device, this awork, a Spartan implementation requires the use a determined device, and inand thisin work, Spartan 3AN7003AN700 device is considered. However, the VHDL modelmodel allowsallows implementing this design in anyinplatform (any device is considered. However, the VHDL implementing this design any platform (any FPGA device or a VLSI system). FPGA device or a VLSI system). In this this figure, figure, the oscillator oscillator Figure 8 shows a simulation of a normal transaction with no attack. In reset is active during the idle state and the sensor begins the initialization sequence when a start condition arrives. arrives. This This sequence sequence begins begins again again when when aa new new cycle cycle of scl signal begins. No No attack attack is condition identified because the attack (busy) signal is not activated. In this case, sda_out and scl_out signals are copies of the sda and scl signals to avoid synchronization synchronization problems problems in in the the communication. communication.

Figure a simulation of aofnormal I2C I2C communication process with with no attack. This Figure 8. 8. Waveform Waveformofof a simulation a normal communication process no attack. communication is performed between the master and the slave whose address is X”B0”. The master This communication is performed between the master and the slave whose address is X”B0”. The master will write write the the value value X”10” X”10” in in the the register register X”00”. X”00”. will

Figure 9 shows a zoom of the waveform shown in Figure 8. Concretely, it shows the operation of a cycle in scl signal. It can be appreciated that the compare signal is active when the period enters the allowed range, and it is deactivated when a new cycle arrives such that it is ready for a new verification. Also, it shows a detail of the initialization sequence in resets signals.

Sensors 2017, 17, 677

10 of 17

Figure 9 shows a zoom of the waveform shown in Figure 8. Concretely, it shows the operation of a cycle in scl signal. It can be appreciated that the compare signal is active when the period enters the allowed range, and it is deactivated when a new cycle arrives such that it is ready for a new verification. Sensorsit2017, 17, 677 10 of 17 Also, shows a detail of the initialization sequence in resets signals. Sensors 2017, 17, 677 10 of 17

Figure 9. Waveform of a zoom of the simulation shown shown in Figurein8,Figure and a detail of the initialization Figure Waveform a zoom the simulation 8, and a detail of the Figure 9.9. Waveform of aofzoom of theofsimulation shown in Figure 8, and a detail of the initialization sequence. sequence. initialization sequence.

Figure 10 10 shows shows the the simulation simulation of of aa communication communication process process with an an attack attack in in cycle number number Figure 10 shows the simulation of a communication process withwith an attack in cycle cycle number eight. eight. In it, the first seven cycles have the correct period, and hence, scl and sda signals pass to scl_out eight. In it, theseven first seven have the correct period, and hence, sclsda andsignals sda signals to scl_out In it, the first cyclescycles have the correct period, and hence, scl and pass pass to scl_out and and sda_out sda_out signals. signals. The 8th 8th cycle cycle does does not arrive arrive because the the attacker attacker wants wants to to disable disable the the and sda_out signals. The 8thThe cycle does not arrivenot because thebecause attacker wants to disable the communication. communication. This action is identified because attack signal is activated, and hence, the sensor communication. This action is identified because attack signal is activated, andsends hence, sensor This action is identified because attack signal is activated, and hence, the sensor thethe response sends the response to the slave. This response begins by sending a stop condition, so that the slave sends the response to the slave. This by sending stopthe condition, so that slave to the slave. This response begins by response sending abegins stop condition, soathat slave closes the the previous closes the the previous previous communication communication process, and and starts listening listening the the sda sda signal signal in order to to check ifif itit is is closes communication process, and startsprocess, listening thestarts sda signal in order to checkiniforder it is thecheck receiver of the receiver of the following communication. After that, a start condition and the address X”B0” the following receiver ofcommunication. the following communication. After that, a and startthe condition the (corresponding address X”B0” After that, a start condition addressand X”B0” (corresponding to the secured slave) are sent. Following, the register address is sent (X”00”); and and (corresponding to theare secured slave) are sent. Following, the register addressand is sent (X”00”); to the secured slave) sent. Following, the register address is sent (X”00”); finally the value finally the value to write is sent (X”10”). Once data have finished, the sensor sends a stop condition finally to write is sentdata (X”10”). data have finished, the asensor sends a stop condition to writethe is value sent (X”10”). Once haveOnce finished, the sensor sends stop condition to finish the to finish the communication process. to finish the communication process. communication process.

Figure 10. Waveform of a simulation of an attacked I2C communication process with the 10. Waveform Figure 10. Waveform ofof aa simulation simulation of of an an attacked attacked I2C I2C communication communication process process with the implemented defense. implemented defense.

4. Case Case Study: the the Navigation of of a Mobile Robot Robot 4. 4. Case Study: Study: the Navigation Navigation of aa Mobile Mobile Robot This section section illustrates aa real real case of of attack against against the clock clock of an an I2C I2C communication communication process process in in This This section illustrates illustrates a realcase case ofattack attack againstthe the clockofof an I2C communication process robotic system. system. Later Later sections sections will will clearly clearly demonstrate the the efficiency of of the proposed proposed sensor in in aa robotic in a robotic system. Later sections will clearlydemonstrate demonstrate theefficiency efficiency ofthe the proposed sensor sensor in defending real systems against this type of attacks. The interest in attacking robots is justified by the defending real real systems systems against against this this type type of of attacks. attacks. The defending The interest interest in in attacking attacking robots robots is is justified justified by by the the use of these systems in a huge variety of contexts. The application presented in this paper is related use of of these these systems systems in in aa huge huge variety variety of of contexts. contexts. The related use The application application presented presented in in this this paper paper is is related with mobile mobile robot robot navigation navigation along along aa previously previously defined defined path. path. It It represents represents aa typical typical situation situation in in with with mobile robot navigation along a previously defined path. It represents a typical situation in many many of the current robotic applications (industry, agriculture, service, etc.), performed whether in many of the current robotic applications (industry, agriculture, service, etc.), performed whether in outdoor or or indoor indoor scenarios scenarios [21,22,29,30]. [21,22,29,30]. outdoor It is is supposed supposed that that user’s user’s intentions intentions involve involve visiting visiting certain certain areas areas of of interest interest by by the the robot. robot. For For It this purpose, a planning algorithm has provided a path that goes through these areas. It is also this purpose, a planning algorithm has provided a path that goes through these areas. It is also assumed that that aa path-tracking path-tracking algorithm algorithm is is applied applied so so that that the the robot robot follows follows this this trajectory trajectory with with assumed precision. precision.

Sensors 2017, 17, 677

11 of 17

of the current robotic applications (industry, agriculture, service, etc.), performed whether in outdoor or indoor scenarios [21,22,29,30]. It is supposed that user’s intentions involve visiting certain areas of interest by the robot. For this purpose, planning algorithm has provided a path that goes through these areas. It is also assumed Sensors 2017,a17, 677 11 of 17 that a path-tracking algorithm is applied so that the robot follows this trajectory with precision. Hence, those who want to interfere with the user’s intentions would try to modify the course of the robot, but ensuring that the user does not realize the robot is under attack (apart from the course modification). Accordingly, Accordingly,thethe planned invariable, and the external planned path path shouldshould remain remain invariable, and the external interference interference may be applied the low actuator, fortime, a short period of time, so thatplace the may be applied to the low leveltoactuator, forlevel a short period of so that the disturbance takes disturbance place temporarily leaving no traces. temporarily takes leaving no traces. The The following following sections sections describe describe the the details details of a real implementation of the aforementioned situations. Attacking Attacking and and defending defending strategies strategies have have been been tested tested in in aa platform platform that that emulates emulates aa mobile robot allowing the authors to validate their hypothesis about clock hacking. 4.1. A A robotic robotic Experimental Experimental Platform experimental platform platform has has been been built built in in order order to to emulate emulate the the motion motion of of a differential drive An experimental analogical instrumentation instrumentation can can be be used used in in order order to robot in virtual environments, so that digital and analogical measure and characterize the behaviors of the hardware against attacks (see (see Figure Figure 11). 11).

Figure Figure 11. 11. The The experimental experimental platform. platform.

In [31] authors have detailed the characteristic of the platform. It implements a control In [31] authors have detailed the characteristic of the platform. It implements a control architecture architecture that includes a high level controller and a low level controller. The high level controller that includes a high level controller and a low level controller. The high level controller is the is the responsible of taking decision about the robot motion, as well as to set the correspondent responsible of taking decision about the robot motion, as well as to set the correspondent actions to be actions to be executed by the actuators. In the case of mobile robot applications, the high level executed by the actuators. In the case of mobile robot applications, the high level controller defines the controller defines the motors’ speed. Then, these values are transferred to the low level controller so motors’ speed. Then, these values are transferred to the low level controller so that motors make the that motors make the robot move in a correct way. In the current application, the high level robot move in a correct way. In the current application, the high level controller is based on a very controller is based on a very well-known path tracking algorithm: Pure Pursuit [21,22,29,32], and the well-known path tracking algorithm: Pure Pursuit [21,22,29,32], and the low level control implements low level control implements a traditional PID controller that transmits orders to the motors driver a traditional PID controller that transmits orders to the motors driver by using I2C protocol. by using I2C protocol. The experimental platform is divided into three different zones (see Figure 12): a Personal The experimental platform is divided into three different zones (see Figure 12): a Personal Computer (PC) that executes Matlab software routines to implement the high level controller; a FPGA Computer (PC) that executes Matlab software routines to implement the high level controller; a device to implement hardware modules (such as the low level controller and the attack module), and a FPGA device to implement hardware modules (such as the low level controller and the attack standard slave device (more concretely an MD23 motor controller [33]). module), and a standard slave device (more concretely an MD23 motor controller [33]). The FPGA device is aimed to implement the hardware modules to obtain a better control of the signals. These modules are an UART based on the RS232 protocol (to communicate with Matlab in a PC), a low level controller (to adapt the orders from Matlab to the rest of modules), an I2C master (to control the communication through I2C protocol), an I2C slave (to test the system inside the FPGA device) and the attack module (to implement the attacks to I2C communications). The platform also includes several measurement elements, highlighted in red in Figure 11: a logic analyzer that monitors the main signals in the communication process, the same PC that monitors the velocity of the motors,

Figure 12. Scheme of the experimental platform.

that motors make the robot move in a correct way. In the current application, the high level controller is based on a very well-known path tracking algorithm: Pure Pursuit [21,22,29,32], and the low level control implements a traditional PID controller that transmits orders to the motors driver by using I2C protocol. SensorsThe 2017,experimental 17, 677 12 of 17 platform is divided into three different zones (see Figure 12): a Personal Computer (PC) that executes Matlab software routines to implement the high level controller; a FPGA device to implement hardware modules (such as the low level controller and the attack and a current measuring device (between the supply source and the motor controller) that monitors module), and a standard slave device (more concretely an MD23 motor controller [33]). the current consumed by the motors.

Figure 12. Scheme of the experimental platform. Figure 12. Scheme of the experimental platform.

The Matlab application has been configured to work with different virtual scenarios and predefined paths. The application receives information from the FPGA regarding the velocity of the motors, and simulates the motion of the robot within the virtual scenario. The high level controller executes an iterative loop that considers this virtual motion and defines control references so that the robot follows a specific path accurately. Communications with the FPGA are performed by the RS232 protocol. The UART implemented in the FPGA receives the speeds references from the PC, and encodes and inserts them in the I2C bus through the I2C master. This module generates SCL and SDA signals as information goes out the FPGA to the motors driver. This driver reads the orders by I2C protocol and changes the speed of the motors consequently. The MD23 controller allows measuring the angular velocities of the motors axes. This value is sent from motors’ driver to the I2C master. The low level controller encodes these values, which are sent to the PC. In Matlab, this information is translated to Cartesian motion by applying dead reckoning techniques, so that the position of the robot is estimated. Hence, new reference values for the motors speeds are generated by the path-tracking algorithm that takes into account the new estimated position and the reference path. This flow is repeated until the robot arrives to the final position of the path. Obviously, this platform is a perfect scenario to test the attacking and defending techniques described in Sections 2 and 3. 4.2. Attacking and Defending Strategies 4.2.1. Attacking Strategy The main idea is to attack the clock signal of the I2C bus in order to interfere with the task of the robot. In this application, the path that the robot follows has been generated in order to ensure that the vehicle goes over some places in a certain order. As a consequence, a first objective for an attacking strategy would be to modify the course of the robot. At a selected moment, when the master tries to communicate with the engines, the attack module acts on the clock, preventing such communication. After that, it sends the acknowledgment. Due of this fact, the attack achieves two effects:

• •

The master module believes that there has been no problem and that the motor follows the references. The slave module receives nothing and maintains the previous speed value.

The consequences of these effects can be dramatic. While the path tracking algorithm orders the robot to follow a collision-free trajectory, the vehicle could go straight ahead and crash into an obstacle. Another way to carry out the attack consists of modifying the robot trajectory without endangering the robot (avoiding possible collisions) but preventing it from correctly performing its task. This most elaborate situation is the one authors have considered. According to this criteria, a successful attack must meet the following set of constraints:

Sensors 2017, 17, 677

(1) (2)

13 of 17

Both during and after the attack, the robot should keep navigating in a safe way. The consequence of the attack is one of these options:

(a) The robot will not reach a specified location. Sensors(b) 2017, 17,The 677 robot will repeat the route to visit a certain area.

13 of 17

these requirements requirements can be be accomplished accomplished by an appropriate appropriate attack that follows the All of these 2.1. As prescriptions detailed in Section 2.1. As it it will be shown in the experimental section, a properly high likelihood likelihood of of succeeding. succeeding. The success only depends on selecting the executed attack has aa high the clock attack. attack. Reverse engineering techniques can be used to optimum moment for implementing the moment and and duration duration of of the the clock clock signal signal interference. interference. determine the moment 4.2.2. 4.2.2. Defending Defending Strategy Strategy The The strategy strategy for for avoiding avoiding this this type type of of attack attack consists consists on on developing developing aa motor motor driver driver that that incorporates incorporates aa sensor sensor similar similar to to the the one one presented presented in in Section Section 33 (see (see Figure Figure 13). 13). Each Each time time the the sensor sensor detects detects aa clock clock attack, attack, it it is is programmed programmed to to generate generate aa sequence sequence of of speed speed commands commands that that order order the the motors to stop. Once the clock attack has finished, the sensor detects that the clock signal is free motors to stop. Once the clock attack has finished, the sensor detects that the clock signal is free of of interferences received from from the the I2C I2C master. Then, interferences and and makes makes the the slave slave follow follow again again the the commands commands received master. Then, the the robot robot can can start start its its navigation navigation again again and and safely safely accomplish accomplish the the predefined predefinedtasks. tasks.

Figure 13. Scheme of the defending strategy. Figure 13. Scheme of the defending strategy.

5. Experimental Results 5. Experimental Results Many experiments have been performed in different virtual environments. The idea was to find Many experiments have been performed in different virtual environments. The idea was to find those types of paths and scenarios in which temporary attacks can accomplish the constraints those types of paths and scenarios in which temporary attacks can accomplish the constraints defined defined in Section 4.2. In [31], it was demonstrated that an appropriate selection for the attack in Section 4.2. In [31], it was demonstrated that an appropriate selection for the attack moment results moment results in a modification of the robot trajectory that prevents it from accomplishing a in a modification of the robot trajectory that prevents it from accomplishing a predefined task. predefined task. One of the most interesting results was found in the scenario of the experiment shown in Figure 14a. This figure indicates with arrows the initial and final positions. In this experiment, the robot evolves describing what can be called a roundabout-like trajectory, in which the robot moves around a specific area (marked also in Figure 14a). In this first experiment, navigation was implemented without any attack, the path-tracking algorithm succeeded in controlling the motion of the robot very close to the planned trajectory. Figure 14b illustrates, in a red line, the reference for the wheels’ speed, provided by the high level controller, and in a blue line, the wheels’ speed provided by the encoder signals (up right motor, down left motor).

(a)

(b)

Many experiments have been performed in different virtual environments. The idea was to find those types of paths and scenarios in which temporary attacks can accomplish the constraints defined in Section 4.2. In [31], it was demonstrated that an appropriate selection for the attack moment results in a modification of the robot trajectory that prevents it from accomplishing a Sensors 2017, 17, 677 14 of 17 predefined task. Sensors 2017, 17, 677

14 of 17

One of the most interesting results was found in the scenario of the experiment shown in Figure 14a. This figure indicates with arrows the initial and final positions. In this experiment, the robot evolves describing what can be called a roundabout-like trajectory, in which the robot moves around a specific area (marked also in Figure 14a). In this first experiment, navigation was implemented without any attack, the path-tracking algorithm succeeded in controlling the motion of the robot very close to the planned trajectory. Figure 14b illustrates, in a red line, the reference for the wheels’ speed, provided by the high level controller, and in a blue line, the wheels’ speed provided by the encoder signals (up right motor, down left motor). In the following experiment (see Figure 15), an attack was implemented on both motors. Figure 15a shows in red the path executed by the robot. Figure 15b represents the wheels’ velocity references (red), and the wheels’ velocity provided by the encoder signals of both motors (blue). A black line delimits the (a) moment of the attack. In this case, the clock(b)attack took place before navigating around the roundabout, and disappeared at the moment when the robot was closer to the Figure 14. Experiment without attack: (a) and followed trajectory; trajectory; wheels velocity end Figure of the 14. roundabout. attack, the robot straight (b) ahead, and exits the Experiment During without the attack: (a) planned planned and navigates followed (b) wheels velocity references and signals from the encoders. roundabout. references and signals from the encoders. Note that, during the attack (see Figure 15b) the high level controller sent references to the motors in order to make robot move to the closer of the path, however, andmotors. due to the attack, In the following experiment (see Figure 15), ansection attack was implemented on both Figure 15a none listened to these commands. When the attack finished the robot is closer to the showsofinthe redmotors the path executed by the robot. Figure 15b represents the wheels’ velocity references final section the path. The tracking algorithm makes the robotofmove to this section, and then, it (red), and theofwheels’ velocity provided by the encoder signals both motors (blue). A black line follows correctly the end. As acase, consequence, the attack because around it prevents delimitsthe thepath moment of thetoattack. In this the clock attack took was placesuccessful before navigating the the system from the roundabout thatwhen was the onerobot of thewas tasks defined theofinitially planned roundabout, and visiting disappeared at the moment closer to thebyend the roundabout. path. During the attack, the robot navigates straight ahead, and exits the roundabout.

(a)

(b)

Figure (b) signal signal from from the the encoders. encoders. Figure 15. 15. Avoiding Avoiding the the roundabout: roundabout: (a) (a) planned planned and and robot robot trajectory; trajectory; (b)

In the next experiment, authors have extended the application of this strategy so that the robot Note that, during the attack (see Figure 15b) the high level controller sent references to the motors keeps navigating around the roundabout instead of avoiding it (see Figure 16). Figure 16a shows in in order to make robot move to the closer section of the path, however, and due to the attack, none of red the path executed by the robot, and Figure 16b represents the velocity references (red) and the the motors listened to these commands. When the attack finished the robot is closer to the final section wheels’ velocity provided by the encoder signals of both motors (blue). The attack is indicated by the of the path. The tracking algorithm makes the robot move to this section, and then, it follows the path black line. correctly to the end. As a consequence, the attack was successful because it prevents the system from The clock attack took place when the roundabout was finishing. From this moment, the robot visiting the roundabout that was one of the tasks defined by the initially planned path. navigates straight ahead. The attack finished when the robot was close to the beginning of the In the next experiment, authors have extended the application of this strategy so that the robot roundabout, then the path tracking algorithm makes the robot follow the roundabout again, visiting keeps navigating around the roundabout instead of avoiding it (see Figure 16). Figure 16a shows in this area twice. red the path executed by the robot, and Figure 16b represents the velocity references (red) and the wheels’ velocity provided by the encoder signals of both motors (blue). The attack is indicated by the black line.

Sensors 2017, 17, 677

15 of 17

Sensors 2017, 17, 677

15 of 17

Sensors 2017, 17, 677

15 of 17

(a)

(b)

Figure 16. Visiting the roundabout twice: (a) planned and robot trajectory; (b) signal from the encoders.

Figure 16. Visiting the roundabout twice: (a) planned and robot trajectory; (b) signal from the encoders.

-1

w [rad·s ]

The These clock results attack confirm took place the roundabout was this moment, robot thatwhen a convenient selection for thefinishing. moment ofFrom the attack can makethe robot (a) (b) changestraight its expected behavior. the when resulting appear to beto“natural”, in fact the navigates ahead. The Nevertheless, attack finished themotions robot was close the beginning of the 16. the Visiting the roundabout twice: (a) planned trajectory; (b) signal from the visiting robotFigure navigates safely and returnsalgorithm to the desired trajectory. Itrobot is follow only evident by the bizarre behavior roundabout, then path tracking makes theand robot the roundabout again, encoders. of the motors that probably no one would understand without knowing of the existence of the this area twice. attack. These results confirm that selection forthe themoment moment the attack make robot These results confirm thata aconvenient convenient selection for ofof the cancan make robot The next experiment illustrates the efficiency of the proposed sensor inattack defending against the change its expected behavior. Nevertheless, the resulting motions appear to be “natural”, in fact change itssituations. expected behavior. Nevertheless, the resulting appear to “natural”,sensor in fact was the the previous As was explained in Section 4.2, in motions this experiment thebefrequency robot navigates safely andand returns to the desired trajectory. only by the the bizarrebehavior behavior of robot navigates safely returns the desired trajectory.Itthe Itisismotors’ only evident evident by connected between the MD23 andtothe I2C bus, protecting drivers frombizarre the attacks. The the motors that probably no oneno would understand without knowing of theofexistence of theofattack. of the motors that probably one would understand without knowing the existence the robot suffered two attacks at the same moments they were performed in the experiments of Figures The next experiment illustrates the efficiency of the proposed sensor in defending against attack. 15 and 16. Figure 17a presents the trajectory of the robot in the attacked/defended experiment, the The next thein efficiency ofdesired the sensor in defending against thewas previous situations. wasillustrates explained Section in proposed thispath. experiment the frequency sensor showing that experiment theAs vehicle accurately follows the4.2, Figure 17b shows the velocity previous situations. As was explained in Section 4.2, in this experiment the frequency sensor was connected between the MD23 and the I2C bus, protecting the motors’ drivers from the attacks. references (red), with the wheels’ velocity provided by the encoder signals of both motors (blue) and between the MD23Observe and thethat, I2C when bus, protecting thewere motors’ drivers the experiments attacks. The of The connected robot suffered two attacks at the same moments they performed in the the attack evolution (black). an attack appears, the velocityfrom references generated robot suffered two attacks at the same moments they were performed in the experiments of Figures Figures 15 and Figurealgorithm 17a presents the trajectory of the robot inthe thevelocity attacked/defended by the path16. tracking are different from zero. However, of the motorsexperiment, evolves 15 and 16. Figure 17a presents the trajectory of the in the attacked/defended to zero—remember that motors under attack onlyrobot the commands byvelocity theexperiment, sensor and showing that the vehicle accurately follows the obey desired path. Figure 17bgenerated shows the references showing that the vehicledoes accurately follows theany desired path. Figure 17b shows thethe velocity the high level controller not perceive that attack has been performed. Once, attack (red), with the wheels’ velocity provided by the encoder signals of both motors (blue) and the attack references (red), with the wheels’ velocity provided by encoder signals of and bothstart motors (blue) and disappears, motors listen correctly the an references thethe high level controller moving again, evolution (black). Observe that, when attackanof appears, the velocity references generated by the the attack evolution (black). Observe that, when attack appears, the velocity references generated accurately following the path. pathby tracking algorithm are different from zero. However, the velocity of the motors evolves the path tracking algorithm are different from zero. However, the velocity of the motors evolves to zero—remember that motors under attack obey only thethe commands and the to zero—remember that motors under attack obey only commandsgenerated generatedby bythe the sensor sensor and 5 800 highthe level controller does not perceive that any attack has been performed. Once, the attack disappears, First attack 4 high level controller does not perceive that any attack has been performed. Once, the attack 3 motors listen 700 correctly the references ofreferences the high level and start and moving again, accurately disappears, motors listen correctly the of the2controller high level controller start moving again, 600 1 accurately following the path. following the path. 0 0

-2

Y (m·10 )

500 400 800

-1

-1 ] w [rad·s ] w [rad·s

First attack

300 700 200 600 100 500 0 400

Second attack 0

100

200

300

400

500

600

700

800

900

-2

X (m·10 )

300

40

60

(a)

-1

200 100

80 t [s]

100

120

140

160

4 5 34 2 3 1 2 0 1 0 0 0

20 20

40 40

60 60

5

w [rad·s ]

-2

Y (m·10 )

20

5

80 t [s] 80 t [s]

100 100

120 120

140 140

160 160

(b)

4 3 2

Figure 17. Avoiding the roundabout: (a) planned and robot trajectory; (b) signal from the encoders. 1

0

Second attack 0

100

200

300

400

0 500 -2

X (m·10 )

(a)

600

700

800

900

0

20

40

60

80 t [s]

100

120

140

160

(b)

Figure 17. Avoiding the roundabout: (a) planned and robot trajectory; (b) signal from the encoders.

Figure 17. Avoiding the roundabout: (a) planned and robot trajectory; (b) signal from the encoders.

Sensors 2017, 17, 677

16 of 17

6. Conclusions This paper pays attention to illustrate an example of attacks on the clock signal in the I2C protocol, and proposes a defense strategy. Particularly, the effect of a clock glitching attack over the communication process between master and slaves has been analyzed. The authors propose the design of a new sensor that represents an effective defense against this type of perturbation. Attacks and defense strategies have been validated in an experimental platform that emulates a differential drive mobile robot. Several experiments concerning mobile robot navigation have been performed. Some particular circumstances have been characterized where I2C clock glitching attacks dramatically increase the robot vulnerability. Experiments show the efficiency of the proposed sensor in detecting and defending the robot from clock attacks. Author Contributions: Fernando Gómez-Bravo, Raúl Jiménez-Naharro and Juan Antonio Gómez-Galán performed the vulnerability analysis and designed the defense sensor; Jonathan Medina-García and Manuel Sánchez-Raya proposed ideas and performed the experiments; Fernando Gómez-Bravo and Juan Antonio Gómez-Galán designed and implemented the robot’s high level controller; Raúl Jiménez-Naharro implemented the low level controller, made the supervision and direction of the work. All authors contributed to the writing and editing of the paper. Conflicts of Interest: The authors declare no conflict of interest.

References 1. 2.

3. 4. 5. 6.

7. 8.

9. 10. 11. 12. 13. 14.

Tehranipoor, M.; Koushanfaar, F. A Survey of Hardware Trojan Taxonomy and Detection. IEEE Tran. Des. Test Comput. 2010, 27, 10–25. [CrossRef] Bruschi, D.; Cavallaro, L.; Lanzi, A.; Monga, M. Replay Attack in TCG Specification and Solution. In Proceedings of the 21st Annual Computer Security Applications Conference, Tucson, AZ, USA, 5–9 December 2005; pp. 11–137. Karaklajic, D.; Schmidt, J.M.; Verbauwhede, I. Hardware Designer’s Guide to Fault Attacks. IEEE Trans. VLSI Syst. 2013, 21, 2295–2306. [CrossRef] Huang, A. Hacking the Xbox: An Introduction to Reverse Engineering; No Starch Press: San Francisco, CA, USA, 2002. Marques, C.; Cristóvão, J.; Alvito, P.; Lima, P.; Frazão, J.; Ribeiro, I.; Ventura, R. A search and rescue robot with tele-operated tether docking system. Ind. Robot 2007, 34, 332–338. [CrossRef] Garcia-Cerezo, A.; Mandow, A.; Martinez, J.L.; Gómez-de-Gabriel, J.; Morales, J.; Cruz, A.; Seron, J. Development of ALACRANE: A mobile robotic assistance for exploration and rescue missions. In Proceedings of the IEEE International Workshop on Safety, Security and Rescue Robotics, Rome, Italy, 27–29 September 2007; pp. 1–6. Moreno, H.A.; Saltaren, R.; Carrera, I.; Puglisi, L.; Aracil, R. Performance Indices of Robotic Manipulators: A review of the State of the Art. Rev. Iberoam. Autom. Inform. Ind. 2012, 9, 111–122. [CrossRef] Park, J.; Jeong, W.; Lee, H.K.; Won, J. An efficient path planning method for a cleaning robot based on ceiling vision. In Proceedings of the IEEE International Conference on Consumer Electronics (ICCE), Las Vegas, NV, USA, 11–14 January 2013. Singh, G. A study of encryption algorithms (RSA, DES, 3DES and AES) for information security. Int. J. Comput. Appl. 2013, 67, 33–38. [CrossRef] Arena, P.; Buscarino, A.; Fortuna, L.; Frasca, M. Separation and synchronization of piecewise linear chaotic systems. Phys. Rev. E 2006, 74, 026212. [CrossRef] [PubMed] Arora, A.; Telang, R.; Xu, H. Optimal policy for software vulnerability disclosure. Manag. Sci. 2008, 54, 642–656. [CrossRef] Heelan, S. Vulnerability detection systems: Think cyborg, not robot. IEEE Secur. Priv. 2011, 9, 74–77. [CrossRef] Anderson, R.; Kuhn, M. Tamper Resistence a Cautionary Note. In Proceedings of the 2nd USENIX Workshop on Electronic Commerce, Oakland, CA, USA, 18–21 November 1996; Volume 2, pp. 1–11. Ladd, A.M.; Bekris, K.E.; Rudys, A.P.; Wallach, D.S.; Kavraki, L.E. On the feasibility of using wireless ethernet for indoor localization. IEEE Trans. Robot. Autom. 2004, 20, 555–559. [CrossRef]

Sensors 2017, 17, 677

15.

16.

17. 18. 19. 20. 21. 22. 23.

24.

25. 26. 27.

28. 29. 30.

31.

32. 33.

17 of 17

Cañas, N.; Hernández, W.; González, G.; Sergiyenko, O. Multivariable controllers for an autonomous ground vehicle: Comparison based on software reliability. Rev. Iberoam. Autom. Inform. Ind. 2014, 11, 179–190. [CrossRef] Sheppard, B.; Thompson, T. Cyber Security for Robots: Scenarios for 2030. Available online: http: //www.roboticsbusinessreview.com/article/cyber_security_for_robots_scenarios_for_2030 (accessed on 23 March 2017). Nobile, C. Robots Vulnerable to Hacking. Robotic Business Review. Available online: http://www. roboticsbusinessreview.com/article/robots_vulnerable_to_hacking (accessed on 23 March 2017). Du, J.; Wu, Y.C. Distributed clock skew and offset estimation in wireless sensor networks: Asynchronous algorithm and convergence analysis. IEEE Trans. Wirel. Commun. 2013, 12, 5908–5917. [CrossRef] Sadler, B.M.; Swami, A. Synchronization in sensor networks: An overview. In Proceedings of the IEEE Military Communications Conference (MILCOM), Washington, DC, USA, 23–25 October 2006; pp. 1–6. Kim, J.S.; Lee, J.; Serpedin, E.; Qaraqe, K. Robust clock synchronization in wireless sensor networks through noise density estimation. IEEE Trans. Signal Process. 2011, 59, 3035–3047. [CrossRef] Morales, J.; Martínez, J.L.; Martínez, M.A.; Mandow, A. Pure-pursuit reactive path tracking for nonholonomic mobile robots with a 2D laser scanner. J. Adv. Signal Process. 2009. [CrossRef] Cuesta, F.; Gómez-Bravo, F.; Ollero, A. Parking maneuvers of industrial-like electrical vehicles with and without trailer. IEEE Trans. Ind. Electr. 2004, 51, 257–269. [CrossRef] McLoughlin, I. Secure embedded system: The threat of reverse engineering. In Proceedings of the 14th International Conference on Parallel and Distributed Systems, Melbourne, Australia, 8–10 December 2008; pp. 729–736. Dutertre, J.M.; Fournier, J.J.; Mirbaha, A.P.; Naccache, D.; Rigaud, J.B.; Robisson, B.; Tria, A. Review of fault injection mechanisms and consequences on countermeasures design. In Proceedings of the 6th IEEE International Conference on Design & Technology of Integrated Systems in Nanoscale Era (DTIS), Athens, Greece, 6–8 April 2011; pp. 1–6. Fukuhara, R.; Day, L.; Luong, H.H.; Rasmussen, R.; Chau, S.N. I2C Bus Protocol Controller with Fault Tolerance. U.S. Patent 6,728,908, 27 April 2004. Alkalai, L.; Chau, S.N.; Tai, A.T. Fault-Tolerant Communication Channel Structures. U.S. Patent 7,020,076, 28 March 2006. Jiménez-Naharro, R.; Gómez-Galán, J.A.; Sánchez-Raya, M.; Gómez-Bravo, F.; Pedro-Carrasco, M. Design and implementation of a new real-time frequency sensor used as hardware countermeasure. Sensors 2013, 13, 11709–11727. [CrossRef] [PubMed] Kömmerling, O.; Kuhn, M.G. Design Principles for Tamper-Resistant Smartcard Processors. Smartcard 1999, 99, 9–20. Ollero, A. Robotics: Manipulators and Mobile Robots; Marcombo: Barcelona, Spain, 2001. Nakhaeinia, D.; Payeur, P.; Hong, T.S.; Karasfi, B. A hybrid control architecture for autonomous mobile robot navigation in unknown dynamic environment. In Proceedings of the IEEE International Conference on Automation Science and Engineering (CASE), Gothenburg, Sweden, 24–28 August 2015; pp. 1274–1281. Gomez-Bravo, F.; Medina García, J.; Jiménez Naharro, R.; Gómez Galán, J.A.; Sánchez Raya, M. Experimental Platform for Studying Hardware Vulnerabilities on Mobile Robots: I2C Bus, a Case of Study. Rev. Iberoam. Autom. 2017, in press. Ollero, A.; Mandow, A.; Muñoz, V.F.; De Gabriel, J.G. Control architecture for mobile robot operation and navigation. Robot. Comput.-Integr. Manuf. 1994, 11, 259–269. [CrossRef] MD23—Dual 12Volt 3Amp H Bridge Motor Drive. Available online: http://www.robotstorehk.com/ motordrivers/doc/md23tech.pdf (accessed on 23 March 2017). © 2017 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (http://creativecommons.org/licenses/by/4.0/).