Information Security of Embedded Systems

28.10.2009: Embedded Systems – Terms and Definitions

Prof. Dr. Holger SchlingloffInstitut für Informatik

undFraunhofer FIRST

28.10.2009Embedded Security © Prof. Dr. H. Schlingloff 2009 2

Structure

1. Introductory example2.Embedded systems

engineering1. definitions and terms2. design principles

3.Foundations of security1. threats, attacks, measures2. construction of safe

systems

4.Design of secure systems1. design challenges2. safety modelling and

assessment3. cryptographic algorithms

5. Communication of embedded systems

1. remote access2. sensor networks

6. Algorithms and measures

1. digital signatures2. key management3. authentification4. authorization

7. Formal methods for security

1. protocol verification2. logics and proof

methods

28.10.2009Embedded Security © Prof. Dr. H. Schlingloff 2009 3

2. Embedded Systems Engineering

Material World

Ideal World

Things Matter, Energy Information

Represen-tation

Shape Form

Transfor-mation

convert (split & splice, cut &

assemble, mould & cast, …)

process (code & recode,

calculate & compute, …)

Transfer move, transmit communicate

28.10.2009Embedded Security © Prof. Dr. H. Schlingloff 2009 4

Technical and Computational System

• Matter / energy = undefined basic term• Technical system = machine/mechanism for the

conversion or relocation of matter and/or energy wheel, car, motor, gears, steel mill, power plant, light bulb, …

• Information = undefined basic term• Information processing = transformation or transfer of

information• System = “something composite”, usually: composed

by humans (“artefact”)• Computational system = Information processing system

= artefact for the transformation or transfer of information “computer”, “calculator”, “processor”

28.10.2009Embedded Security © Prof. Dr. H. Schlingloff 2009 5

Embedded System

• Embedded system = computational system within a technical system (information processing component of technical syst.) designed, built and operated as a fixed component special purpose, in contrast to general-purpose interaction with physical environment via designated interfaces reactivity and real-time behaviour

• Characteristic attributes often for control tasks often mass-produced, consumer goods, cheap commodity mostly hard to maintain or extend sometimes safety-relevant or safety-critical communicating, connected, ubiquitous, pervasive, ambient, …

28.10.2009Embedded Security © Prof. Dr. H. Schlingloff 2009 6

Examples

• How many embedded systems are in this room?• How many embedded systems did you encounter today?

28.10.2009Embedded Security © Prof. Dr. H. Schlingloff 2009 7

Embedded System or Not?

•Phone

•Watch

•Robot

•Assembly line

•Factory

•SAP-System in factory

28.10.2009Embedded Security © Prof. Dr. H. Schlingloff 2009 8

Market Areas (cf. [Fränzle])

• Transport technologies motor/gear control, X-by-wire,

position and dynamics stabilisation, ABS, passenger comfort, …

traffic guidance, signal lights, radar localisation, …

• Communication technologies cell phone, dect-phone, DSL-

modem, router, switch, …• Office equipment

fax machine, copier, printer, pointer, …

• Household appliances watch, microwave, toaster, gas

burner, washing machine, audio/video-equipment, remote control unit, gaming, …

• Trade and Services ticket machine, sales

automaton, taxometer, cash machine, …

• Building automation and control heating, lighting, elevators,

locking and sentry services, security functions

• Production- and environmental technology power and production plants,

emission control, robotics• Medical technology

ambient devices, hospital equipment, diagnosis and treatment instruments

28.10.2009Embedded Security © Prof. Dr. H. Schlingloff 2009 9

Market Relevance

• over 10 billion embedded processor unit shipments in 2008• 99.6 % of all processors are used in embedded systems• 87,6% of all produced microcontrollers are „pre-Win98-CPUs“

(DSPs, FPGAs, and MCUs), of which 57,6% are 8-Bit-processors

W. Schröder-Preikschat, http://www4.informatik.uni-erlangen.de/~wosch/Talks/040108HUB.pdf, zitiertQuelle: D. Tennenhouse. Proactive Computing. Communications of the ACM, 43(5):43–50, May 2000http://www.embeddedstar.com/weblog/2009/02/19/embedded-systems-practice/

28.10.2009Embedded Security © Prof. Dr. H. Schlingloff 2009 10

Predictable Future

• The trend will continue more new embedded processors than humans per year elektronics as consumable goods (e.g. RFID, post cards)

• Ubiquitous computing, ambient assisted living smart clothing (CeBIT `08) glasses with hearing aids,

augmented reality watch with UMTS talking neckties?

• SoC, „System-on-Chip“• „Smart Dust“, sensor networks• Intelligent agents, autonomous systems• …

28.10.2009Embedded Security © Prof. Dr. H. Schlingloff 2009 11

Specific Problems of Embedded Systems

• Designed, built and operated as a fixed component of a technical system physical and mechanical constraints, assembly near the

controlled process (e.g. inside jet engine or inside tyre) physical stress

• Special purpose, fixed tasks efficiency, minimal resource consumption predefined interfaces

• Interaction with physical environment sensor and actuator design mechanical impreciseness feedback effects unreliability of sensors and actuators

• Reactivity and real-time behaviour operating systems requirements verification problems

28.10.2009Embedded Security © Prof. Dr. H. Schlingloff 2009 12

Announcement

28.10.2009Embedded Security © Prof. Dr. H. Schlingloff 2009 13

Further Design Challenges

• Often for control tasks interaction of civil engineers and software engineers

• Often mass-produced, consumer goods, cheap commodity cost pressure for production (optimisation within cents) resource limitation (e.g. bandwidth, energy)

• Mostly hard to maintain or extend maintainance costs vs. development costs vs. production

costs no „service packs“, everything must be correct at first launch callback or guarantee replacement can be desastrous

• Sometimes safety-relevant or safety-critical reliability, availability, maintainability (RAM) fault tolerance

• Communicating, connected, ubiquitous, ambient, … synchronization, multi-core deployment, feature interaction

28.10.2009Embedded Security © Prof. Dr. H. Schlingloff 2009 14

Embedded Systems Design

•Waterfall or V-Model small to medium design groups civil engineers, electrical engineers software often not valued

•Model-based design Matlab/Simulink, UML code generation

•Product lines no real system is developed “from scratch” look-and-feel, component reuse