DETECTION AND PREVENTION: TOWARD SECURE MOBILE ROBOTIC SYSTEMS

Abstract

Mobile robotic systems are widely deployed and are rapidly evolving in almost every aspect of the modern society, including household, entertainment, manufacturing, security and national defense, etc. The evolution has been driven by the developments in wireless communication, sensing, mobile computing, and autonomous control. While the technologies are dedicated to advance the robotics industry, ironically, a wide spectrum of safety and security risks arises from themselves. Researchers and industry practitioners have demonstrated that mobile robotic systems are significantly threatened by various intentional attacks and unintentional failures due to the extra surfaces introduced by these technologies. These threats can be exploited by adversaries to thwart normal operations and lead to misbehaviors. Unlike safety and security threats in traditional information and computation systems where the consequences are typically constrained within the cyberspace where software runs, e.g., denial-of-service, privacy breaches, data corruption, etc., threats in mobile robotic systems could be abused by adversaries into disastrous consequences such as physical damages or human injuries.

In order to defeat attacks and failures raised in mobile robotic systems, researchers propose countermeasures including both detection and preventive approaches. However, there are still gaps between existing defense schemes and the properties of real-world robotic systems, e.g., nonlinearity, noises. Moreover, facing more experienced adversaries and the ever-growing functionality fruitfulness, many dangerous revealed/potential attacks or failures cannot be holistically handled by existing defense schemes. Therefore, the robotics world remains insecure.

This dissertation research studies the detection and prevention of attacks and failures within mobile robotic systems. Regarding the detection problem, we focus on active misbehaviors that are capable of actively altering system behaviors and directly causing damages to the physical world. To defeat active misbehaviors, we propose a practical intrusion detection approach that detects misbehaviors that target on various robot components and are launched from various channels. The approach leverages the physical dynamics of mobile robots to detect misbehaviors in sensors and actuators. We explore issues raised in real-world implementations, e.g., distinctive robot dynamic models, sensor quantity and quality, decision choices, etc., for practicality purposes. We develop two detection methods under both single and networked contexts. In terms of a preventive approach, we present a protection mechanism that provides generic reference monitoring in the context of modern commodity vehicles. The mechanism leverages trusted execution environment featured by modern ARM-architecture boards to build a trusted computing base. We design a message firewall as a demonstrative example enabled by the protection mechanism.

 

Chapter 1 |

Introduction

Recent years have witnessed a rapid growth in the robotics industry. According to International Data Corporation [1] , global spending on robotics and related services will reach $135 billion in 2019. The sheer size of the volume is mainly accounted from defense and security, agricultural, medical-care, and manufacturing applications [2] . Mobile robotic systems, as a typical type of robotic systems, have capabilities of movement in specific work environments and carry out specific missions assigned by humans. Some representative mobile robotic systems include household cleaning robots such as Roomba, military surveillance drones such as Global Hawk, aerial photography unmanned aerial vehicles (UAV) such as DJI Phantom, Amazon warehouse robots, etc. Major tech companies (e.g. Google, Uber, Tesla) are leading intensive developments of autonomous cars in order to replace human drivers in near future [3] .

Today’s mobile robotic systems are no longer collections of analog and mechanical components. Unlike traditional cyber systems such as computers and mobile phones, mobile robotic systems are characterized by a strong coupling of the cyberspace and the physical world in which they operate. Mobile robotic systems are equipped with sensors, actuators and computational devices, i.e., electronic control units (ECUs).

In a typical control iteration, sensors (e.g. GPS, accelerometer) measure the states (e.g. position, orientation, velocity, etc.) and their surrounding world, and feed the readings to ECUs or human operators. Using sensor perceptions, ECUs or human operators generate control commands based on mission specifications, and actuators (e.g. rotor, wheel) execute them in the physical world.

1.1 Motivation

The popularity of this emerging technology introduces safety and security threats to the community. Mobile robotic systems inherit vulnerabilities from their cyber components, and such vulnerabilities can be exploited by adversaries to transcend cyber defenses and further escalate into disastrous consequences in the physical world. Moreover, the fruitful sensors, actuators, and ECUs also introduce extra attack surfaces and vulnerabilities from both the cyber channel and physical channel into mobile robotics systems. In traditional cyber systems, the potential impact of a threat is typically constrained within the cyberspace. For instance, a ransomware could infect computers and encrypt files for ransom. It blocks user access to computers or the data within (Denial-of-Service). The Heartbleed vulnerability [4] allows attackers to read sensitive memory, potentially including cryptographic keys and credentials (privacy leakage). However, mobile robotic systems are designed for carrying out safety-critical missions with physical world interactions. Attacks or failures in mobile robotic systems could lead to catastrophic consequences such as property damages and human injuries. Recently, researchers demonstrated several remote hacks into a Jeep Cherokee [5] and Tesla newest models [6] , and were able to control their actuators such as steering wheels and gas pedals. In 2011, an American surveillance drone was claimed to be brought down by Iranian cyberwarfare unit through GPS spoofing attacks [7] . In 2013, a multi-million yacht was demonstrated to be hijacked and controlled using spoofed GPS signals [8] . Hence, it becomes an imperative issue to ensure the security of mobile robots.

Security researchers have been defending mobile robotic systems with a variety of solutions. Two main streams of defenses are proposed: preventive protection and intrusion detection. Preventive approaches employ message encryption and authentication during message communication [9–12] , e.g., MAC, secret key management, etc. However, preventive protections typically incur significant amount of extra computational resources and time consumption, which are not acceptable in mobile robotic systems that runs critical applications. Moreover, relying on preventive approaches cannot defeat certain attacks or failures. Hence, detection approaches serve as remedies for such limitations.

Intrusion and anomaly detection has long been studied in cyber-security. Traditional host-based IDSs [13–16] monitor the system behaviors (e.g. filesystem logs, system calls) of a single host. Network-based approaches [17–21] from mobile ad hoc networks and wireless sensor networks incorporate networking traffic in their detection processes. However, both categories are dedicated to the detection of attacks or failures launched within cyberspace. Data corruption attacks or failures from physical channels (e.g. sensor spoofing) cannot be detected since no abnormal cyberspace behavior would be triggered and captured. Several approaches are proposed to complement existing cyberspace IDSs. One representing spectrum of detection is the estimation-based approaches [22–30] . These approaches utilize estimation theory and compare estimated data with observed data. Detected discrepancy indicates data corruption in the corresponding data sources.

1.2 Techniques Overview

This dissertation research explores practical and generically adaptable approaches to defend mobile robotic systems against various attacks and failures. At a high level, we propose both detection and preventive approaches and demonstrate their practicality in different distinctive mobile robotic systems. The dissertation starts with a model-based anomaly detection using a control theoretical approach. The detection method leverages the physical dynamics of mobile robotic systems to detect misbehaviors in sensors and actuators. It has the following properties. First, the method handles nonlinear systems subject to sensing and actuation noises. This enables the detection method to be applicable in majority of real-world mobile robotic systems. Second, the method is capable of detecting anomalies arise from both cyber and physical channels targeting on both sensors and actuators. Hence, it provides a generic approach for anomaly detection. Third, the method works on distinctive robot dynamic models, sensor quantity and quality, and actuators. This property further demonstrates the generality and the practicality.

Inspired by the above method, we explore anomaly detection in a networked context where multiple mobile robotic systems works together. Following the same key insight within the aforementioned detection approach, I develop a collaborative intrusion detection method which does not need a centralized authority for the arbitration purpose. The method fuses local sensing information and that from nearby agents together to enhance detection capabilities. Under a networked context, the collaborative detection method are more robust against intrusions.

The development of the previous two detection methods carries two essential requirements in order to function properly, which are: 1) the detection system has access to ground truth control commands, and 2) the detection system and the controller of a mobile robotic system cannot be malicious. Lacking either requirement will result in erroneous detection. For instance, if an attacker is capable of subverting the controller execution, e.g., through return oriented programming or firmware overwrite, he/she can corrupt the control commands generated by the controller and craft malicious commands to achieve his/her malicious intention. Under such case, the detection system remains silent because no deviation can be detected between planned control commands and executed commands, and no deviation can be detected between sensor readings as well.

Furthermore, anomaly detection reacts to threats passively. These approaches are designed to report only after an attack or a failure takes place. Considering the mission criticality of mobile robotic systems, preventive approaches are necessary to proactively defend the systems before attacks or failures could happen. We study modern vehicles as a motivating example and develop a preventive mechanism to protect the interface between the ECUs and the central communication bus in vehicles.

More details of the proposed methods and mechanism are presented in the sequel.

1.2.1           Anomaly Detection in a Single Mobile Robot

We focus on the detection of misbehaviors that actively influence the behavior of mobile robotic systems and cause damages in the physical world. Down to their consequences, active misbehaviors can be classified into sensor misbehaviors and actuator misbehaviors. Sensor misbehaviors, e.g., GPS spoofing, alter authentic sensor readings received by controller units. Actuator misbehaviors, e.g., steering wheel take-over, directly alter control commands executed by robot actuators. A misbehavior could be caused by multiple sources. We focus on the detection of misbehaviors, rather than identifying how they originate in the first place. In addition, we do not consider passive attacks or failures that do not affect robot motion behaviors, e.g., eavesdropping attacks.

To detect the two types of mobile robot misbehaviors, we propose a robot anomaly detection system (RoboADS) using a model-based estimation approach. Beyond the knowledge audited by cyber-layer intrusion detection approaches, the approach leverages a second source of knowledge learned from interacting with the physical world. In particular, the physical dynamics of mobile robots impose constraints on the maneuver of mobile robots. These constraints can be leveraged as a detection vector to provide essential information that reflects ground truth statuses. The second source of knowledge is neither obtained nor used in cyber-layer intrusion detection approaches. Leveraging robot dynamic models, RoboADS builds correlations between potentially corrupted sensor readings and control commands. Using robot states as intermediate, authentic sensor readings and control commands are estimated. The discrepancies found between estimated values and measured values indicate the occurrence of misbehaviors.

RoboADS is capable of detecting both types of misbehaviors raised from both cyber and physical channels in a single mobile robotic system. Noticeably, the information provided by physical dynamics allows for detecting sensor and actuator misbehaviors without resorting to majority voting or Byzantine thresholds. A salient limitation is that it requires one or multiple sensors in the system to be clean. Powerful attackers (as demonstrated in [5] ) could potentially corrupt all sensors. For instance, an attacker could exploit a backdoor vulnerability in the sensing data processing library and corrupt all sensor readings in a consistent way to avoid the detection.

1.2.2          Collaborative Detection in a Connected Context

Going beyond RoboADS, we explore the detection in a networked context where multiple mobile robotic systems work together. Each system has certain observation and communication capability over others. Under a networked context where systems are connected, the inter observation and communication provide new vectors for detection. In this dissertation, we study modern connected vehicle as a representative example of networked mobile robotics systems. We develop VCIDS, a collaborative intrusion detection system for the connected vehicle. It fuses local sensing information and that from nearby vehicles to enhance detection capabilities. We deploy VCIDS on a scaled autonomous vehicle testbed and demonstrate its detection capabilities even under destructive attack scenarios where all sensors on certain vehicles are corrupted.

VCIDS complements RoboADS on the limitation that at least one sensor remains clean. The method provides a scalable property to increase the robustness of mobile robotic systems by adding more agents into a network.

1.2.3  Reference Monitoring on ECUs with Trusted Execution Environment

A survivable detection solution relies on the integrity of the detection module and the controller. How to ensure the integrity of these modules while other parts of the system are vulnerable to adversaries is not addressed. In addition, we intend to explore approaches to proactively protect mobile robotic systems and prevent attacks before they happen and influence normal operations.

We design a mechanism that leverages trusted execution environment features provided in modern mobile computing processors. Trusted execution environment (TEE) stands for a set of hardware, firmware, and/or software components that can be leveraged for conducting security sensitive tasks. TEE is designated to run a smallest amount of code that we trust in order to meet the minimum security requirement of a system. The code set is referred to as a trusted computing base (TCB). In mobile robotic systems with intrusion detection needs, the controller and and the IDS should be designed as a TCB. The controller and and the IDS typically maintain minimum code complexity and undergo extensive tests or verification before deployment.

We study modern commodity vehicle as a motivating example and leverage the

TrustZone technology as the TEE provided in many ARM-architecture based ECUs. We develop a reference monitor to monitor and filter CAN messages communicated between an ECU and the CAN bus inside a vehicle.

1.3 Summary of Contributions

In summary, this dissertation research makes the following contributions.

• This dissertation research develops and implements practical and generic methods to detect attacks and failures in real-world mobile robotic systems. Two methods, RoboADS and VCIDS, are developed for the detection in single and networked mobile robotic systems, respectively. Both methods leverage the physical dynamics of mobile robots and use model-based approach to build models between sensor readings, robot states, and control commands. RoboADS considers a single robot, while VCIDS consider a group of networked systems where each system has observation and communication over others. We build prototypes for both detection methods on two types of mobile robots and evaluate them with respect to their effectiveness and efficiency against various attacks and failures. The evaluations show accurate detection and negligible detection delays.
• This dissertation research develops and implements a preventive defense mechanism called CANGuard that leverages trusted execution environments to build a trusted computing base for various applications. We build a CANGuard prototype on an embedded system running a real vehicle infotainment system. We demonstrate the effectiveness and the efficiency of CANGuard by evaluating the prototype against attacks launched on real commodity vehicles. The results show CANGuard defeats attacks and incurs minimal overhead for transmitting CAN messages.

For the ease of presentation, we refer to mobile robotic systems simply as robots in the rest of this dissertation.

The remainder of the dissertation is organized as follows. Chapter 2 presents the methods on the anomaly detection of sensor and actuator misbehaviors. Chapter 3, presents the development of the previous chapter and explores a detection method under a networked context. Chapter 4 presents a preventive defense approach leveraging a trusted execution environment. Chapter 5 proposes future research directions and concludes the dissertation.

DETECTION AND PREVENTION: TOWARD SECURE MOBILE ROBOTIC SYSTEMS

Sharing is caring!