Protecting motion sensors from acoustic injection attack
Cyber-physical systems depend on sensors to make automated decisions. Resonant acoustic injection attacks are already known to cause malfunctions by disabling MEMS-based gyroscopes. However, an open question remains on how to move beyond denial of service attacks to achieve full adversarial control of sensor outputs. This work investigates how analog acoustic injection attacks can damage the digital integrity of a popular type of sensor: the capacitive MEMS accelerometer. Spoofing such sensors with intentional acoustic interference enables an out-of-spec pathway for attackers to deliver chosen digital values to microprocessors and embedded systems that blindly trust the unvalidated integrity of sensor outputs. Two software-based solutions are presented for mitigating acoustic interference with output of a MEMS accelerometer and other types of motion sensors.
1. A method for determining an output from a motion sensor, comprising:
receiving, by a signal processor, an output signal from the motion sensor, where the output signal exhibits a known resonant frequency;
sampling, by the signal processor, the output signal at a sampling frequency, where the sampling frequency is less than or equal to the known resonant frequency and sampling time for each sample is determined as a function of a sampling period and a random delay; and
determining, by the signal processor, an output for the motion sensor by averaging the samples from the output signal.
2. The method of claim 1 wherein sampling the output signal further comprises setting the sampling time in accordance with
t* k =t k +t delay
where t k is a sampling period and t delay is a random delay.
3. The method of claim 2 wherein the random delay is uniformly distributed across the resonant period.
4. The method of claim 2 wherein sampling the output signal further comprises generating the random delay using a true random number generator.
5. The method 2 wherein the motion sensor exhibits multiple resonant frequencies and the random delay is uniformly distributed in a period equal to the least common multiple of all resonant frequencies exhibited by the motion sensor.
6. The method of claim 1 wherein the motion sensor is a microelectromechanical system (MEMS).
7. The method of claim 1 wherein the motion sensor if further defined as an accelerometer.
8. A system for mitigating effects of acoustic interference with output of a motion sensor, comprising:
a motion sensor configured to detect motion of an object and operable to output a signal indicative of the detected motion, where the signal exhibits a known resonant frequency;
a random number generator configured to generate a random number; and
a signal processor in data communication with the motion sensor and the random number generator, the signal processor samples the signal at a sampling frequency and generates an output by averaging the samples from the signal, where the sampling frequency is less than or equal to the known resonant frequency and sampling time for each sample is determined as a function of a sampling period and a random delay.
9. The system of claim 8 wherein the motion sensor is a microelectromechanical system (MEMS).
10. The system of claim 8 wherein the motion sensor if further defined as an accelerometer.
11. The system of claim 8 wherein the signal processor sets the sampling time by adding a random delay to the sampling period and the random delay is uniformly distributed across the resonant period.
12. The system of claim 11 wherein the motion sensor exhibits multiple resonant frequencies and the random delay is uniformly distributed in a period equal to the least common multiple of all resonant frequencies exhibited by the motion sensor.
13. A method for determining an output from a motion sensor, comprising:
receiving, by a signal processor, an output signal from the motion sensor, where the output signal exhibits a known resonant frequency;
sampling, by the signal processor, the output signal at a sampling frequency, where the sampling frequency is less than or equal to the known resonant frequency and sampling time for each sample is chosen randomly; and
determining, by the signal processor, an output for the motion sensor by averaging the samples from the output signal,
wherein sampling the output signal further comprises setting the sampling time in accordance with
t* k =t k +t delay
where t k is a sampling period and t delay is a random delay.
14. The method of claim 13 wherein the random delay is uniformly distributed across the resonant period.
15. The method of claim 13 wherein sampling the output signal further comprises generating the random delay using a true random number generator.
16. The method 13 wherein the motion sensor exhibits multiple resonant frequencies and the random delay is uniformly distributed in a period equal to the least common multiple of all resonant frequencies exhibited by the motion sensor.
17. The method of claim 13 wherein the motion sensor is a microelectromechanical system (MEMS).
18. The method of claim 13 wherein the motion sensor if further defined as an accelerometer.