PowerAlert: An Integrity Checker using Power Measurement

TL;DR

PowerAlert is a novel integrity checking system that uses power measurements to verify code execution on untrusted hosts, addressing limitations of existing methods by leveraging power modeling and diversification.

Contribution

It introduces a power-based integrity checker that detects tampering by comparing power measurements against learned models and diversifies checks to prevent attacker adaptation.

Findings

PowerAlert effectively detects tampering with high probability.

The system deters attackers by forcing trade-offs between stealth and detection risk.

Power measurement-based checks outperform timing-based methods in accuracy.

Abstract

We propose PowerAlert, an efficient external integrity checker for untrusted hosts. Current attestation systems suffer from shortcomings in requiring complete checksum of the code segment, being static, use of timing information sourced from the untrusted machine, or use of timing information with high error (network round trip time). We address those shortcomings by (1) using power measurements from the host to ensure that the checking code is executed and (2) checking a subset of the kernel space over a long period of time. We compare the power measurement against a learned power model of the execution of the machine and validate that the execution was not tampered. Finally, power diversifies the integrity checking program to prevent the attacker from adapting. We implement a prototype of PowerAlert using Raspberry pi and evaluate the performance of the integrity checking program generation. We model the interaction between PowerAlert and an attacker as a game. We study the effectiveness of the random initiation strategy in deterring the attacker. The study shows that \power forces the attacker to trade-off stealthiness for the risk of detection, while still maintaining an acceptable probability of detection given the long lifespan of stealthy attacks.