A Framework for Evaluating Security in the Presence of Signal Injection Attacks

TL;DR

This paper presents a comprehensive framework and methodology for evaluating and quantifying the security of sensor systems against electromagnetic and other signal injection attacks, including practical measurements and analysis.

Contribution

It introduces a unifying system and threat model, security definitions, and an algorithm for assessing real system vulnerabilities to signal injection attacks.

Findings

Demonstrated susceptibility of a smartphone microphone to signal injection

Analyzed demodulation characteristics of commercial ADCs

Provided a practical algorithm for security level calculation

Abstract

Sensors are embedded in security-critical applications from medical devices to nuclear power plants, but their outputs can be spoofed through electromagnetic and other types of signals transmitted by attackers at a distance. To address the lack of a unifying framework for evaluating the effects of such transmissions, we introduce a system and threat model for signal injection attacks. We further define the concepts of existential, selective, and universal security, which address attacker goals from mere disruptions of the sensor readings to precise waveform injections. Moreover, we introduce an algorithm which allows circuit designers to concretely calculate the security level of real systems. Finally, we apply our definitions and algorithm in practice using measurements of injections against a smartphone microphone, and analyze the demodulation characteristics of commercial Analog-to-Digital Converters (ADCs). Overall, our work highlights the importance of evaluating the susceptibility of systems against signal injection attacks, and introduces both the terminology and the methodology to do so.

Figures

Tables

Table 1. Table 1 : Correspondence between security properties of a sensor system, adversarial injection attacks, and the resulting ADC waveform errors (signals).

Security	Injection	ADC Error $E_s\left(t\right)$
Universal	Existential	Bounded away from $0$
Selective	Selective	Target waveform $w\left(t\right)$
Existential	Universal	Non-trivial waveforms $w\left(t\right)$

Table 2. Table 2 : The adversary can easily disturb the smartphone output (existential injection), and inject human speech (universal injection). Selective injections of sines are less precise than exponentials of the same frequency.

Injection	Resulting Signal	Crit. Thres.
Existential	$w\left(t\right)\ne 0$	$0.892$
Selective	$w\left(t\right)=e^{\sin \left(2\pi f_{m}t\right)}$	$0.747$
Selective	$w\left(t\right)=\sin \left(2\pi f_{m}t\right)$	$0.562$
Universal	“OK Google” commands	$\le 0.562$

Table 3. Table 3 : Mean and std. deviation ( μ , σ ) 𝜇 𝜎 (\mu,\sigma) of critical selective thresholds ϵ c w superscript subscript italic-ϵ 𝑐 𝑤 \epsilon_{c}^{w} for different target signals w ​ ( t ) 𝑤 𝑡 w(t) . Injections using the clean waveform are always more successful than with the distorted waveform. Validation signals are injected with high fidelity, and are better modeled by an exponential rather than a pure sine.

Waveform	Validation	Ideal Sine	$e^{\text{Ideal Sine}}$	$w\left(t\right)\ne 0$
Clean	$(0.98,0.03)$	$(0.56,0.04)$	$(0.75,0.06)$	$(0.89,0.01)$
Distorted	$(0.95,0.09)$	$(0.31,0.05)$	$(0.34,0.05)$	$(0.71,0.04)$

Table 4. Table 4 : The ADCs used in our experiments cover a range of different properties.

ADC	Manufacturer	Package	Type	Bits	Max $f_s$		$f_{cut}$
TLC549	Texas Instruments	DIP	SAR	8	$40\mathrm{kHz}$		$2.7\mathrm{MHz}$
ATmega328P	Atmel	Integrated	SAR	10	$76.9\mathrm{kHz}$		$0.1\text{-}11.4\mathrm{MHz}$
Artix7	Xilinx	Integrated	SAR	12	$1\mathrm{MHz}$		$5.3\mathrm{MHz}$
AD7276	Analog Devices	TSOT	SAR	12	$3\mathrm{MHz}$		$66.3\mathrm{MHz}$
AD7783	Analog Devices	TSSOP	$\Delta \Sigma$	24	$19.79\mathrm{Hz}$		[$50$,$60\mathrm{Hz}$]
AD7822	Analog Devices	DIP	Flash	8	$2\mathrm{MHz}$		$128.4\mathrm{MHz}$

Equations

$$v_{out}=\left(\frac{a_2{\hat{v}}^2}{2}+\frac{3a_4{\hat{v}}^4}{8}+\cdots \right)+\left(a_1\hat{v}+\cdots \right)\sin (\omega t)-\left(\frac{a_2{\hat{v}}^2}{2}+\cdots \right)\cos (2\omega t)+\cdots$$

$$Q=\frac{V_{max}-V_{min}}{2^{N+1}}\ge |s-\tilde{s}|$$

$$N(x)=\text{Pr}\left[|n(t)|\le x\right]={\int }_{-x}^{x}p(u)du$$

$$N^{-1}(ϵ)=\inf \{x\ge 0:N(x)=ϵ\}$$

$$E_s(t)=\{\begin{array}{ll}\left|{\tilde{s}}_f(t+\tau )-s(t)\right|& \text{if a conversion starts at t}\\ 0& \text{otherwise}\end{array}$$

$$Pr\left[E_s(t)\ge Q+N^{-1}\left(\frac{ϵ+1}{2}\right)\right]\le \frac{ϵ+1}{2}$$

$$Pr\left[E_s(t)\ge Q+N^{-1}\left(\frac{ϵ+1}{2}\right)\right]=Pr\left[|n(t)|\ge x\right]=$$

$$=1-\frac{ϵ+1}{2}=\frac{1-ϵ}{2}\le \frac{ϵ+1}{2}$$

$$Pr\left[E_s(t)\ge Q+N^{-1}\left(\frac{ϵ+\delta +1}{2}\right)\right]\le$$

$$Pr\left[E_s(t)\ge Q+N^{-1}\left(\frac{ϵ+1}{2}\right)\right]\le \frac{ϵ+1}{2}\le \frac{ϵ+\delta +1}{2}$$

$$Pr\left[E_{s+w}(t)\ge Q+N^{-1}\left(\frac{(1-ϵ)+1}{2}\right)\right]>\frac{2-ϵ}{2}$$

$$P$$

$$\ge Pr\left[E_{s+w}(t)\ge Q+N^{-1}\left(\frac{1-ϵ+1}{2}\right)\right]>\frac{2-ϵ}{2}\ge \frac{2-(ϵ+\delta )}{2}$$

$$\rho \left(X,Y\right)=\frac{\text{cov}\left(X,Y\right)}{{\sigma }_X{\sigma }_Y}=\frac{{\sum }_{i=1}^n\left(x_i-{\mu }_x\right)\left(y_i-{\mu }_y\right)}{\sqrt{{\sum }_{i=1}^n{\left(x_i-{\mu }_x\right)}^2}\sqrt{{\sum }_{i=1}^n{\left(y_i-{\mu }_y\right)}^2}}$$

$$\text{lag}\left(s_a,s_b\right)=\underset{n}{\mathrm{argmax}}\left(\left(s_a\star s_b\right)\left(n\right)\right)$$

$$\text{similarity}\left({\tilde{s}}_f,w\right)=\rho \left({\tilde{s}}_f,w^{lag}\right)$$

$$V_{RMS}=\frac{\sqrt{2}}{2}\mu {\left(V_{RMS}^{Adv}\right)}^2\left|H_2\left(f_c,-\left(f_c-f_m\right)\right)\right|$$

Full text

1 Introduction

In our daily routine we interact with dozens of sensors: from motion detection in home security systems and tire pressure monitors in cars, to accelerometers in smartphones and heart rate monitors in smartwatches. The integrity of these sensor outputs is crucial, as many security-critical decisions are taken in response to the sensor values. However, specially-crafted adversarial signals can be used to remotely induce waveforms into the outputs of sensors, thereby attacking pacemakers [10], temperature sensors [5], smartphone microphones [9], and car-braking mechanisms [20]. These attacks cause a system to report values which do not match the true sensor measurements, and trick it into performing dangerous actions such as raising false alarms, or even delivering defibrillation shocks.

The root cause of these vulnerabilities lies in the unintentional side-effects of the physical components of a system. For example, the wires connecting sensors to microcontrollers behave like low-power, low-gain antennas, and can thus pick up high-frequency electromagnetic radiations. Although these radiations are considered “noise” from an electrical point of view, hardware imperfections in the subsequent parts of the circuit can transform attacker injections into meaningful waveforms. Specifically, these radiations are digitized along with the true sensor outputs, which represent a physical property as an analog electrical quantity. This digitization process is conducted by Analog-to-Digital Converters (ADCs), which, when used outside of their intended range, can cause high-frequency signals to be interpreted as meaningful low-frequency signals.

Despite the potential that signal injection attacks have to break security guarantees, there is no unifying framework for evaluating the effect of such adversarial transmissions. Our work fills this gap through the following contributions:

We propose a system model which abstracts away from engineering concerns associated with remote transmissions, such as antenna design (Section 2). 2. 2.

We define security against adversarial signal injection attacks. Our definitions address effects ranging from mere disruptions of the sensor readings, to precise waveform injections of attacker-chosen values (Section 3). 3. 3.

We introduce an algorithm to calculate the security level of a system under our definitions and demonstrate it in practice by injecting “OK Google” commands into a smartphone (Section 4). 4. 4.

We investigate how vulnerable commercial ADCs are to malicious signal injection attacks by testing their demodulation properties (Section 5). 5. 5.

We discuss how our model can be used to inform circuit design choices, and how to interpret defense mechanisms and other types of signal injection attacks in its context (Section 6).

Overall, our work highlights the importance of testing systems against signal injection attacks, and proposes a methodology to test the security of real devices.

2 System and Adversary Model

Remote signal injection attacks pose new challenges from a threat-modeling perspective, since the electrical properties of systems suggest that adversaries cannot arbitrarily and precisely change any sensor reading. To create a threat model and define security in its context, we need to first abstract away from specific circuit designs and engineering concerns related to remote transmissions. To do so, we separate the behavior of a system into two different transfer functions. The first function describes circuit-specific behavior, including how adversarial signals enter the circuit (e.g., through PCB wires acting as antennas), while the second one is ADC-specific, and dictates how the signals which have made it into the circuit are digitized. We describe this model in greater detail in Section 2.1, taking a necessary detour into electrical engineering to show why our proposal makes for a good system model. We then explain some sources of measurement errors even in the absence of an adversary in Section 2.2 and finish by detailing the capabilities and limitations of the adversary in Section 2.3. Both sub-sections are crucial in motivating the security definitions of Section 3.

2.1 Circuit Model

Analog-to-Digital Converters (ADCs) are central in the digitization process of converting signals from the analog to the digital realm, and our circuit block diagram (Figure 1) reflects that. In the absence of an adversary, the ADC digitizes the sensor signal $s(t)$ as well as the environmental noise $n(t)$, and transfers the digital bits to a microcontroller. We model the ADC in two parts: an “ideal” ADC which simply digitizes the signal, and a transfer function $H_{A}$. This transfer function describes the internal behavior of the ADC, which includes effects such as filtering and amplification. The digitized version of the signal $\tilde{s}_{f}(t)$ depends both on this transfer function, and the sampling frequency $f$ of the ADC. An adversarial signal can enter the system (e.g., through the wires connecting the sensor to the ADC) and add to the sensor signal and the noise. This process can be described by a second, circuit-specific transfer function $H_{C}$, which transforms the adversarial signal $v(t)$ into $\tilde{v}(t)$. Note that components such as external filters and amplifiers in the signal path between the point of injection and the ADC can be included in either $H_{A}$ or $H_{C}$. We include them in $H_{A}$ when they also affect the sensor signal $s(t)$, but in $H_{C}$ when they are specific to the coupling effect. $H_{C}$ and $H_{A}$ are discussed in detail below.

Circuit Transfer Function $H_{C}$. To capture the response of the circuit to external signal injections, we introduce a transfer function $H_{C}$. This transfer function explains why the adversarial waveforms must be modulated, and why it is helpful to try and reduce the number of remote experiments to perform. For electromagnetic interference (EMI) attacks, the wires connecting the sensor to the ADC pick up signals by acting as (unintentional) low-power and low-gain antennas, which are resonant at specific frequencies related to the inverse of the wire length [12]. Non-resonant frequencies are attenuated more, so for a successful attack the adversary must transmit signals at frequencies with relatively low attenuation. For short wires, these frequencies are in the $\mathrm{GHz}$ range [12], so the low-frequency waveform $w(t)$ that the adversary wants to inject into the output of the ADC $\tilde{s}_{f}(t)$ may need to be modulated over a high-frequency carrier using a function $M$. We denote this modulated version of the signal by $v(t)=M(w(t))$.

$H_{C}$ is also affected by passive and active components on the path to the ADC, and can also be influenced by inductive and capacitive coupling for small transmission distances, as it closely depends on the circuit components and their placement. Specifically, it is possible for 2 circuits with “the same components, circuit topology and placement area” to have different EMI behavior depending on the component placement on the board [13]. Despite the fact that it is hard to mathematically model and predict the behavior of circuits in response to different signal transmissions, $H_{C}$ can still be determined empirically using frequency sweeps. It presents a useful abstraction, allowing us to separate the behavior of the ADC (which need only be determined once, for instance by the manufacturer) from circuit layout and transmission details.

Note, finally, that $H_{C}$ can also account for distance factors between the adversary and the circuit under test: due to the Friis transmission formula [4], as distance doubles, EMI transmission power needs to quadruple. This effect can be captured by increasing the attenuation of $H_{C}$ by $6\text{\,}\mathrm{dB}$, while defense mechanisms such as shielding can be addressed similarly. This approach allows us to side-step engineering issues of remote transmissions and reduce the number of parameters used in the security definitions we propose in Section 3.

ADC Transfer Function $H_{A}$. Every system with sensors contains one or more ADCs, which may even be integrated into the sensor chip itself. ADCs are not perfect, but contain components which may cause a mismatch between the “true” value at the ADC input and the digitized output. In this section, we describe how these components affect the digitization process.

Although there are many types of ADCs, every ADC contains three basic components: a “sample- or track-and-hold circuit where the sampling takes place, the digital-to-analog converter and a level-comparison mechanism” [15]. The sample-and-hold component acts as a low-pass filter, and makes it harder for an adversary to inject signals modulated at high frequencies. However, the level-comparison mechanism is essentially an amplifier with non-linearities which induces DC offsets, and allows low-frequency intermodulation products to pass through. These ADC-specific transformations, modeled through $H_{A}$, unintentionally demodulate high-frequency signals which are not attenuated by $H_{C}$. They are explored in more detail in Section 5 and Appendix 0.A.

Sample-And-Hold Filter Characteristics. A sample-and-hold (S/H) mechanism is an $RC$ circuit connected to the analog input, with the resistor and the capacitor connected in series (Figure 2). The transfer function of the voltage across the capacitor is $H_{S/H}(j\omega)=\frac{1}{1+j\omega RC}$, and the magnitude of the gain is $G_{S/H}=\frac{1}{\sqrt{1+\left(\omega RC\right)^{2}}}$. As the angular frequency $\omega=2\pi f$ increases, the gain is reduced: the S/H mechanism acts as a low-pass filter. The $-3\text{\,}\mathrm{dB}$ cutoff frequency is thus $f_{cut}=\frac{1}{2\pi RC}$, which is often higher than the ADC sampling rate (Section 5). Hence, “aliasing” occurs when signals beyond the Nyquist frequency are digitized by the ADC: high-frequency signals become indistinguishable from low-frequency signals which the ADC can sample accurately.

Amplifier Non-Linearities. Every ADC contains amplifiers: a comparator, and possibly buffer and differential amplifiers. Many circuits also contain additional external amplifiers to make weak signals measurable. All these amplifiers have harmonic and intermodulation non-linear distortions [17], which an adversary can exploit. Harmonics are produced when an amplifier transforms an input $v_{in}$ to an output $v_{out}=\sum_{n=1}^{\infty}a_{n}v_{in}^{n}$. In particular, if $v_{in}=\hat{v}\cdot\sin(\omega t)$, then:

[TABLE]

This equation shows that “the frequency spectrum of the output contains a spectral component at the original (fundamental) frequency, [and] at multiples of the fundamental frequency (harmonic frequencies)” [17]. Moreover, the output includes a DC component, which depends only on the even-order non-linearities of the system. Besides harmonics, intermodulation products arise when the input signal is a sum of two sinusoids (for instance when the injected signal sums with the sensor signal): $v_{in}=\hat{v}_{1}\cdot\sin(\omega_{1}t)+\hat{v}_{2}\cdot\sin(\omega_{2}t)$. In that case, the output signal contains frequencies of the form $n\omega_{1}\pm m\omega_{2}$ for integers $n,m\neq 0$. These non-linearities demodulate attacker waveforms, even when they are modulated on high-frequency carriers.

Diode Rectification. Figure 2 shows that the input to an ADC can contain reverse-biased diodes to ground and $V_{cc}$ to protect the input from Electrostatic Discharge (ESD). When the input to the ADC is negative, or when it exceeds $V_{cc}$, the diodes clamp it, causing non-linear behavior. When the sensor signal $s(t)$ is positive, this behavior is also asymmetric, causing a DC shift [17], which compounds with the amplifier non-linearities.

Conclusion. All ADCs contain the same basic building blocks, modeled through $H_{A}$. Although the sample-and-hold mechanism should attenuate high-frequency signals beyond the maximum sampling rate of the ADC, non-linearities due to ESD diodes and amplifiers in the ADC cause DC offsets and the demodulation of signals through harmonics and intermodulation products. Section 5 and Appendix 0.A exemplify these effects through experiments on different ADCs.

2.2 Sampling Errors in the Absence of an Adversary

The digitization process through ADCs entails errors due to quantization and environmental noise. Quantization errors exist due to the inherent loss of accuracy in the sampling process. An ADC can only represent values within a range, say between $V_{min}$ and $V_{max}$ volts, with a finite binary representation of $N$ bits, called the resolution of the ADC. In other words, every value between $V_{min}$ and $V_{max}$ is mapped to one of the $2^{N}$ values that can be represented using $N$ bits. As a result, there is a quantization error between the true sensor analog value $s$ and the digitized value $\tilde{s}$. The maximum value of this error is

[TABLE]

The second source of error comes from environmental noise, which may affect measurements. We assume that this noise, denoted by $n(t)$, is independent of the signal being measured, and that it comes from a zero-mean distribution, i.e., that the noise is white. The security definitions we introduce in Section 3 require an estimate of the level of noise in the system, so we introduce some relevant notation here. We assume that $n(t)$ follows a probability distribution function (PDF) $p(x)$, and define $N(x)$ as the probability that the noise is between $-x$ and $x$, as shown in Figure 3, i.e.,

[TABLE]

Note that typically the noise is assumed to come from a normal distribution, but this assumption is not necessary in our models and definitions.

We are also interested in the inverse of this function, where given a probability $0\leq\epsilon<1$, we want to find $x\geq 0$ such that $N(x)=\epsilon$. For this $x$, the probability that the noise magnitude falls within $[-x,x]$ is $\epsilon$, as also shown in Figure 3. Because for some distributions there might be multiple $x$ for which $N(x)=\epsilon$, we use the smallest such value:

[TABLE]

Since $N(x)$ is an increasing function, so is $N^{-1}(\epsilon)$.

To account for repeated measurements, we introduce a short-hand for sampling errors, which we denote by $E_{s}(t)$. The sampling errors depend on the sensor input into the ADC $s(t)$, the sampling rate $f$, the discrete output of the ADC $\tilde{s}_{f}(t)$ as well as the conversion delay $\tau$, representing the time the ADC takes for complete a conversion:

[TABLE]

2.3 Adversary Model

Our threat model and definitions can capture a range of attacker goals, from attackers who merely want to disrupt sensor outputs, to those who wish to inject precise waveforms into a system. We define these notions precisely in Section 3, but here we describe the attacker capabilities based on our model of Figure 1. Specifically, in our model, the adversary can only alter the transmitted adversarial signal $v(t)$. He/she cannot directly influence the sensor signal $s(t)$, the (residual) noise $n(t)$, or the transfer functions $H_{A}$ and $H_{C}$. The adversary knows $H_{A}$, $H_{C}$, and the distribution of the noise $n(t)$, although the true sensor signal $s(t)$ might be hidden from the adversary (see Section 3.2). The only constraint placed on the adversarial signal is that the attacker is only allowed to transmit signals $v(t)$ whose peak voltage level is bounded by some constant $V_{PK}^{Adv}$, i.e., $|v(t)|\leq V_{PK}^{Adv}$ for all $t$. We call this adversary a $V_{PK}^{Adv}$-bound adversary, and all security definitions are against such bounded adversaries.

We choose to restrict voltage rather than restricting power or distance, as it makes for a more powerful adversarial model. Our model gives the adversary access to any physical equipment necessary (such as powerful amplifiers and highly-directional antennas), while reducing the number of parameters needed for our security definitions of Section 3. Distance and power effects can be compensated directly through altering $V_{PK}^{Adv}$, or indirectly by integrating them into $H_{C}$, as discussed in Section 2.1.

3 Security Definitions

Using the model of Figure 1, we can define security in the presence of signal injection attacks. The $V_{PK}^{Adv}$-bound adversary is allowed to transmit any waveform $v(t)$, provided that $|v(t)|\leq V_{PK}^{Adv}$ for all $t$: the adversary is only constrained by the voltage budget. Whether or not the adversary succeeds in injecting the target waveform $w(t)$ into the output of the system depends on the transfer functions $H_{C}$ and $H_{A}$. For a given system described by $H_{A}$ and $H_{C}$, there are three outcomes against an adversary whose only restriction is voltage:

The adversary can disturb the sensor readings, but cannot precisely control the measurement outputs, an attack we call existential injection. The lack of existential injections can be considered universal security. 2. 2.

The adversary can inject a target waveform $w(t)$ into the ADC outputs with high fidelity, performing a selective injection. If the adversary is unable to succeed, the system is selectively secure against $w(t)$. 3. 3.

The adversary can universally inject any waveform $w(t)$. If there is any non-trivial waveform for which he/she fails, the system is existentially secure.

This section sets out to precisely define the above security notions by accounting for noise and quantization error (Equation (1)). Our definitions capture the intuition that systems are secure when there are no adversarial transmissions, and are “monotonic” in voltage, i.e., systems are more vulnerable against adversaries with access to higher-powered transmitters. Our definitions are also monotonic in noise: in other words, in environments with low noise, even a small disturbance of the output is sufficient to break the security of a system. Section 3.1 evaluates whether an adversary can disturb the ADC output away from its correct value sufficiently. Section 3.2 then formalizes the notion of selective security against target waveforms $w(t)$. Finally, Section 3.3 introduces universal injections by defining what a non-trivial waveform is. The three types of signal injection attacks, the corresponding security properties, and the ensuing ADC errors (injected waveforms) are summarized in Table 1.222 The terminology chosen was inspired by attacks against signature schemes, where how broken a system is depends on what types of messages an attacker can forge [8].

3.1 Existential Injection, Universal Security

The most primitive type of signal injection attack is a simple disruption of the sensor readings. There are two axes in which this notion can be evaluated: adversarial voltage and probability of success (success is probabilistic, as noise is a random variable). For a fixed probability of success, we want to determine the smallest voltage level for which an attack is successful. For a fixed voltage level, we want to find the probability of a successful attack. Alternatively, if we fix both the voltage and the probability of success, we want to determine if a system is secure against disruptive signal injection attacks.

The definition for universal security is a formalization of the above intuition, calling a system secure when, even in the presence of injections (bounded by adversarial voltage), the true analog sensor value and the ADC digital output do not deviate by more than the quantization error and the noise, with sufficiently high probability. Mathematically:

Definition 1 (Universal Security, Existential Injection)

For $0\leq\epsilon<1$, and $V_{PK}^{Adv}\geq 0$, we call a system universally $(\epsilon,V_{PK}^{Adv})$-secure if

[TABLE]

for every adversarial waveform $v(t)$, with $|v(t)|\leq V_{PK}^{Adv}$ for all $t$. $Q$ is the quantization error of the system, $N^{-1}$ is the noise distribution inverse defined in Equation (2), and $E_{s}$ is the sampling error as defined by Equation (3). The probability is taken over the duration of the attack, i.e., at each sampling point within the interval $t_{start}\leq t\leq t_{end}$. We call a successful attack an existential injection, and simply call a system universally $\epsilon$-secure, when $V_{PK}^{Adv}$ is implied.

We first show that in the absence of injections, the system is universally $\epsilon$-secure for all $0\leq\epsilon<1$. Indeed, let $x=N^{-1}\left(\frac{\epsilon+1}{2}\right){}$, so that $Pr\left[|n(t)|\leq x\right]=\frac{\epsilon+1}{2}{}$. Then, in the absence of injections,

[TABLE]

which holds for all $0\leq\epsilon<1$, as desired. This proof is precisely the reason for requiring a noise level and probability of at least 50% in the definition: the proof no longer works if $(1+\epsilon)/2$ is replaced by just $\epsilon$. In other words, mere noise would be classified as an attack by the modified definition.

Voltage. We now show that a higher adversarial voltage budget can only make a system more vulnerable. Indeed, if a system is universally $(\epsilon,V_{1})$-secure, then it is universally $(\epsilon,V_{2})$-secure for $V_{2}\leq V_{1}$. For this, it suffices to prove the contrapositive, i.e., that if a system is not universally $(\epsilon,V_{2})$-secure, then it is not universally $(\epsilon,V_{1})$-secure. For the proof, let $v(t)$ be an adversarial waveform with $|v(t)|\leq V_{2}$ such that Equation (4) does not hold, which exists by the assumption that the system is not universally $(\epsilon,V_{2})$-secure. Then, by the transitive property, $|v(t)|\leq V_{1}$, making $v(t)$ a valid counterexample for universal $(\epsilon,V_{1})$ security.

Probability. The third property we show is probability monotonicity, allowing us to define a “critical threshold” for $\epsilon$, above which a system is universally secure (for a fixed $V_{PK}^{Adv}$), and below which a system is not universally secure. Indeed, for fixed $V_{PK}^{Adv}$, if a system is universally $(\epsilon,V_{PK}^{Adv})$-secure, then it is universally $(\epsilon+\delta,V_{PK}^{Adv})$-secure for $0\leq\delta<1-\epsilon$, as

[TABLE]

because $N^{-1}$ is increasing. The contrapositive is, of course, also true: if a system is not universally secure for a given $\epsilon$, it is also not universally secure for $\epsilon-\delta$ with $0\leq\delta\leq\epsilon$.

Thresholds. For a given security level $\epsilon$, then, we can talk about the maximum (if any) $V_{PK}^{Adv}$ such that a system is universally $(\epsilon,V_{PK}^{Adv})$-secure, or conversely the minimum (if any) $V_{PK}^{Adv}$ such that a system is not universally $(\epsilon,V_{PK}^{Adv})$-secure. This is the critical universal voltage level $V_{c}$ for the given $\epsilon$. Moreover, for any $V_{PK}^{Adv}$, there is a unique critical universal security threshold $\epsilon_{c}$ such that the system is universally $(\epsilon,V_{PK}^{Adv})$-secure for $\epsilon_{c}<\epsilon<1$ and not universally $(\epsilon,V_{PK}^{Adv})$-secure for $0\leq\epsilon<\epsilon_{c}$. By convention we take $\epsilon_{c}=0$ if the system is secure for all $\epsilon$, and $\epsilon_{c}=1$ if there is no $\epsilon$ for which the system is secure. This critical threshold indicates the security level of a system: the lower $\epsilon_{c}$ is, the better a system is protected against signal injection attacks.

3.2 Selective Injection and Security

The second definition captures the notion of security against specific target waveforms $w(t)$: we wish to find the probability that a $V_{PK}^{Adv}$-bounded adversary can make $w(t)$ appear in the output of the ADC. Conversely, to define security in this context, we must make sure that the digitized signal $\tilde{s}_{f}(t)$ differs from the waveform $s(t)+w(t)$ with high probability, even if plenty of noise is allowed. There are two crucial points to notice about the waveform $w(t)$. First, $w(t)$ is not the raw signal $v(t)$ the adversary is transmitting, as this signal undergoes two transformations via $H_{C}$ and $H_{A}$. Instead, $w(t)$ is the signal that the adversary wants the ADC to think that it is seeing, and is usually a demodulated version of $v(t)$ (see Figure 1). Second, $w(t)$ does not necessarily cancel out or overpower $s(t)$, because that would require predictive modeling of the sensor signal $s(t)$. However, if the adversary can predict $s(t)$ (e.g., by monitoring the output of the ADC, or by using identical sensors), we can then ask about security against the waveform $w^{\prime}(t)=w(t)-s(t)$ instead. Given this intuition, we can define selective security as follows:

Definition 2 (Selective Security, Selective Injection)

For $0\leq\epsilon<1$, and $V_{PK}^{Adv}\geq 0$, a system is called selectively $(\epsilon,w(t),V_{PK}^{Adv})$-secure if

[TABLE]

for every adversarial waveform $v(t)$, with $|v(t)|\leq V_{PK}^{Adv}$ for all $t$, where the probability is taken over the duration of the attack. $Q$ is the quantization error of the system, $N^{-1}$ is the noise distribution inverse defined in Equation (2), and $E_{s+w}(t)=\left|\tilde{s}_{f}(t+\tau)-s(t)-w(t)\right|$ during sampling periods, and [math] otherwise. We call a successful attack a selective injection, and simply call a system selectively $\epsilon$-secure, when $V_{PK}^{Adv}$ and $w(t)$ are clear from context.

This definition is monotonic in voltage and the probability of success, allowing us to talk about “the” probability of success for a given waveform:

Voltage. A similar argument shows that increasing $V_{PK}^{Adv}$ can only make a secure system insecure, but not vice versa, i.e., that if a system is selectively $(\epsilon,w(t),V_{1})$-secure, then it is selectively $(\epsilon,w(t),V_{2})$-secure for $V_{2}\leq V_{1}$. We can thus define the critical selective voltage level $V_{c}^{w}$ for a given $\epsilon$ and $w(t)$.

Probability. If a system is selectively $\epsilon$-secure (against a target waveform and voltage budget), then it is selectively $(\epsilon+\delta)$-secure for $0\leq\delta<1-\epsilon$, because

[TABLE]

If the system is not selectively $\epsilon$-secure, then it is not selectively $(\epsilon-\delta)$-secure.

Given the above, for a given waveform $w(t)$ and fixed $V_{PK}^{Adv}$, we can define a waveform-specific critical selective security threshold $\epsilon_{c}^{w}$ such that the system is vulnerable for all $\epsilon^{w}$ with $0\leq\epsilon^{w}<\epsilon_{c}^{w}$ and secure for all $\epsilon^{w}$ with $\epsilon_{c}^{w}<\epsilon^{w}<1$. By convention we take $\epsilon_{c}^{w}=0$ if there is no $\epsilon$ for which the system is vulnerable, and $\epsilon_{c}^{w}=1$ if there is no $\epsilon$ for which the system is secure.

Threshold Relationship. The critical universal threshold of a system $\epsilon_{c}$ is related to the critical selective threshold $\epsilon_{c}^{0}$ against the zero waveform $w(t)=0$ through the equation $\epsilon_{c}^{0}=1-\epsilon_{c}$. Indeed, if a system is not universally $\epsilon$-secure, then $P=Pr\left[E_{s}(t)\geq Q+N^{-1}\left(\frac{\epsilon+1}{2}\right){}\right]>\frac{\epsilon+1}{2}{}$, so $\frac{2-(1-\epsilon)}{2}=\frac{\epsilon+1}{2}{}<P=Pr\left[E_{s+0}(t)\geq Q+N^{-1}\left(\frac{(1-(1-\epsilon))+1}{2}\right)\right]$, making the system selectively $(1-\epsilon)$-secure for the zero waveform. Conversely, if a system is selectively $(1-\epsilon)$-secure for the zero waveform, then it is not universally $\epsilon$-secure. The fact that a low critical universal threshold results in a high critical selective threshold for the zero threshold is not surprising: it is easy for an adversary to inject a zero signal by simply not transmitting anything.

3.3 Universal Injection, Existential Security

The final notion of security is a weak one, which requires that the adversary cannot inject at least one “representable” waveform into the system, i.e., one which is within the ADC limits. We can express this more precisely as follows:

Definition 3 (Representable Waveform)

A waveform $w(t)$ is called representable if it is within the ADC voltage levels, and has a maximum frequency component bounded by the Nyquist frequency of the ADC. Mathematically, $V_{min}\leq w(t)\leq V_{max}$ and $f_{max}\leq f_{s}/2$.

Using this, we can define security against at least one representable waveform:

Definition 4 (Existential Security, Universal Injection)

For $0\leq\epsilon<1$, and $V_{PK}^{Adv}\geq 0$, a system is called existentially $(\epsilon,V_{PK}^{Adv})$-secure if there exists a representable waveform $w(t)$ for which the system is selectively $(\epsilon,w(t),V_{PK}^{Adv})$-secure. We call a system existentially $\epsilon$-secure when $V_{PK}^{Adv}$ is clear. If there is no such $w(t)$, we say that the adversary can perform any universal injection.

As above, voltage and probability are monotonic in the opposite direction.

Voltage. If a system is existentially $(\epsilon,V_{1})$-secure, then it is $(\epsilon,V_{2})$-secure for $V_{2}\leq V_{1}$. By assumption, there is a representable $w(t)$ such that the system is selectively $(\epsilon,w(t),V_{1})$-secure. By the previous section, this system is $(\epsilon,w(t),V_{2})$-secure, concluding the proof.

Probability. If a system is existentially $(\epsilon_{1},V)$-secure, then it is $(\epsilon_{2},V)$-secure for $\epsilon_{1}\leq\epsilon_{2}$. By assumption, there is a representable $w(t)$ such that the system is selectively $(\epsilon_{1},w(t),V)$-secure. By the previous section, the system is also $(\epsilon_{2},w(t),V)$-secure, as desired.

Thresholds. Extending the definitions of the previous sections, for fixed $\epsilon$ we can define a critical existential voltage level $V_{c}^{exist}$ below which a system is existentially $\epsilon$-secure, and above which the system is existentially $\epsilon$-insecure. Similarly, for a fixed adversarial voltage we can define the critical existential security threshold $\epsilon_{c}^{exist}$, above which the system is existentially secure, and below which the system is insecure.

In some cases, security designers may wish to adjust the definitions to restrict target waveforms (and existential security counterexamples) even further. For instance, we might wish to check whether an adversary can inject all waveforms which are sufficiently bounded away from 0, periodic waveforms, or waveforms of a specific frequency. The proofs for voltage and probability monotonicity still hold, allowing us to talk about universal security against $\mathcal{S}$-representable waveforms: waveforms which are representable and also in a set $\mathcal{S}$.

4 Security Evaluation of a Smartphone Microphone

In this section, we illustrate how our security definitions can be used to determine the security level of a commercial, off-the-shelf smartphone microphone. We first introduce an algorithm to calculate the critical selective security threshold $\epsilon_{c}^{w}$ against a target waveform $w(t)$ in Section 4.1. We then use the algorithm to calculate the critical thresholds of a smartphone in Section 4.2. Finally, we comment on universal security in Section 4.3, where we show that we are able to inject complex “OK Google” commands. We summarize our results in Table 2, while Appendix 0.A contains additional experiments for further characterization of the smartphone’s ADC.

4.1 Algorithm for Selective Security Thresholds

In this section, we introduce an algorithm to calculate the critical selective security threshold $\epsilon_{c}^{w}$ of a system against a target waveform $w(t)$, using a transmitted signal $v(t)$. The first step in the algorithm (summarized in pseudocode as Algorithm 1) is to determine the noise distribution. To that end, we collect $N$ measurements of the system output $\tilde{s}_{f}(t)$ during the injection and pick one as the reference signal. We then pick $1\leq k\leq N-2$ of them to calculate the noise (estimation signals), while the remaining are used to verify our calculations (validation signals).

Our algorithm first removes any DC offset and re-scales the measurements so that the root-mean-square (RMS) voltages of the signals are the same. The repeated measurements are then phase-aligned, and we calculate the distance between the reference signal and the estimation signals. The average of this distance should be very close to 0, as the signals are generated in the same way. However, the standard deviation $\sigma$ is non-zero, so we can model noise as following a zero-mean normal distribution $n(t)\sim N(0,\sigma^{2})$. We can then find the critical threshold between the reference signal and any target ideal waveform $w(t)$ as follows: we first detrend, scale, and align the ideal signal to the reference waveform, as with the estimation signals. Then, we calculate the errors (distance) between the ideal and the reference signal. Finally, we perform a binary search for different values of $\epsilon$, in order to find the largest $\epsilon$ for which Equation (5) does not hold: this is the critical threshold $\epsilon_{c}^{w}$. To calculate the inverse of the noise, we use the percentile point function $ppf(\epsilon)$, which is the inverse of the cumulative distribution function, and satisfies $N^{-1}(\epsilon)=ppf((1+\epsilon)/2)$. Note that since the critical universal threshold $\epsilon_{c}$ is related to the selective critical threshold of the zero waveform $\epsilon_{c}^{0}$ through $\epsilon_{c}=1-\epsilon_{c}^{0}$ (Section 3.2), the same algorithm can be used to calculate the critical universal security threshold $\epsilon_{c}$.

4.2 Existential and Selective Injections into a Smartphone

We demonstrate how our algorithm can be used in a realistic setup using a Motorola XT1541 Moto G3 smartphone. We inject amplitude-modulated $f_{m}=$1\text{,}\mathrm{kHz} signals using a Rohde & Schwarz SMC100A/B103 generator into the headphone jack of the phone, following direct power injection (DPI) methodology [[7](#bib.bib7)]. We collect $N=10$ measurements of $2^{15}$ sample points per run using an “Audio Recorder” app, and record the data at a frequency of $f_{s}=$44.1\text{\,}\mathrm{kHz} in a $\left[-1,1\right]$ dimensionless range (AAC encoding). We first amplitude-modulate $f_{m}$ over $f_{c}=$200\text{,}\mathrm{MHz} using an output level of $V_{RMS}^{Adv}=V_{PK}^{Adv}/\sqrt{2}=$0.2\text{\,}\mathrm{V}. This injection is demodulated well by the smartphone and has a “similarity” (see Appendix 0.A) of over $0.98$ compared to a pure $1\text{\,}\mathrm{kHz}$ tone. We call this example the “clean” waveform. The second injection, which we call the “distorted” waveform, uses $f_{c}=$25\text{,}\mathrm{MHz}, $V_{RMS}^{Adv}=$0.9\text{\,}\mathrm{V}, and has a similarity of less than $0.55$ to the ideal tone. Example measurements of these signals and “ideal” signals (see below) are shown in Figure 4.

The algorithm first calculates the noise level using the reference signals. As expected, the error average is very close to 0 (usually less than $10^{-6}$), while the standard deviation $\sigma$ is noticeable at around $0.0015$. Taking the reference signals as the target signal $w(t)$, the critical selective thresholds are close to $1$. In other words, even if the injected waveforms do not correspond to “pure” signals, the adversary can inject them with high fidelity: the system is not selectively secure against them with high probability.

We also tried two signals as the signal $w(t)$ that the adversary is trying to inject: a pure $1\text{\,}\mathrm{kHz}$ sine wave, and an exponential of the same sine wave. The averages and standard deviations for the calculated thresholds over all combinations of $k$ and reference signals are shown in Table 3. As we would expect, the thresholds for the distorted waveform are much lower than the values for the clean waveform: the signal is distorted, so it is hard to inject an ideal signal. We also find that the exponential function is a better fit for the signal we are seeing, and can better explain the harmonics. Table 3 also includes the critical universal injection threshold based on the two waveform injections. This threshold is much higher for both waveforms, as injections disturb the ADC output sufficiently, even when the demodulated signal is not ideal.

4.3 Universal Injections on a Smartphone

In this section, we demonstrate that the smartphone is vulnerable to the injection of arbitrary commands, which cause the smartphone to behave as if the user initiated an action. Using the same setup of direct power injection (Section 4.2), we first inject a modulated recording of “OK Google, turn on the flashlight” into the microphone port, checking both whether the voice command service was activated in response to “OK Google”, and whether the desired action was executed. We repeat measurements 10 times, each time amplitude-modulating the command at a depth of $\mu=1.0$ with $V_{RMS}^{Adv}=$0.6\text{,}\mathrm{V} on 26 carrier frequencies $f_{c}$: $25\text{\,}\mathrm{MHz}$, $50\text{\,}\mathrm{MHz}$, and $1002400\text{\,}\mathrm{MHz}$ at a step of $100\text{\,}\mathrm{MHz}$. The voice-activation feature (“OK Google”) worked with 100% success rate (10/10 repetitions) for all frequencies, while the full command was successfully executed for 23 of the 26 frequencies we tested (all frequencies except $f_{c}\in\{1.3,2.0,2.4$\mathrm{GHz}$\}$). Increasing the output level to $V_{RMS}^{Adv}=$0.9\text{\,}\mathrm{V}, increased success rate to 25/26 frequencies. Only $f_{c}=$2.4\text{,}\mathrm{GHz}$$ did not result in a full command injection, possibly because the Wi-Fi disconnected in the process.

We repeated the above injections, testing 5 further commands to (1) call a contact; (2) text a contact; (3) set a timer; (4) mute the volume; and (5) turn on airplane mode. The results remained identical, regardless of the actual command to be executed. As a result, all carrier frequencies which are not severely attenuated by $H_{C}$ (e.g., when coupling to the user’s headphones) are vulnerable to injections of complex waveforms such as human speech.

5 Commercial ADC Response $H_{A}$ to Malicious Signals

As explained in Section 2, an adversary trying to inject signals remotely into a system typically needs to transmit modulated signals over high-frequency carriers. As $H_{C}$ is unique to each circuit and needs to be re-calculated even for minor changes to its components and layout [6], the first step to determine the system vulnerability is to understand the behavior $H_{A}$ of the ADC used.

To do so, we inject signals into the ADCs to determine their demodulation characteristics. As shown in Figure 5, the output of the Rohde & Schwarz signal generator is directly connected to the ADC under test, while additional experiments with an amplifier or with remote transmissions are performed in Appendix 0.A. An Arduino Uno (ATmega328P microcontroller) interfaces with the ADC over the appropriate protocol, while a computer collects the measurements from the microcontroller over the UART, and controls the signal generator over the VISA interface.

Experiments are conducted with six ADCs from four manufacturers (Texas Instruments, Analog Devices, Atmel, and Xilinx) in different packages: some are part of the silicon in other ICs, while others are standalone surface-mount or through-hole chips. Delta-Sigma ($\Delta\Sigma$), half-flash, and successive approximation (SAR) ADCs are tested, with sampling rates $f_{s}$ ranging from a few $\mathrm{Hz}$ to several $\mathrm{MHz}$, and resolutions between $8$ and $24$ bits. Table 4 shows these properties along with the $-3\text{\,}\mathrm{dB}$ cutoff frequency $f_{cut}$, calculated using the $R,C$ parameters in the ADCs’ datasheets.

We use sinusoidals of frequencies $f_{m}$ that have been amplitude-modulated on carrier frequencies $f_{c}$. In other words, we consider the intended signal to be $w(t)=\sin(2\pi f_{m}t)$, the sensor signal to be absent ($s(t)=0$), and evaluate how “close” $w(t)$ is to the ADC output $\tilde{s}_{f}(t)$. We summarize typical results for each ADC here, and present more details in Appendix 0.A.

ATmega328P. Figure 6 presents two example measurements of outputs of the ATmega328P, both in the time domain and in the frequency domain. The input to the ADC is a $f_{m}=$1\text{,}\mathrm{Hz} signal modulated over different high-frequency carriers. As shown in the frequency domain (bottom of Figure [6](#S5.F6)), the fundamental frequency $f_{m}$ dominates all other frequencies, so the attacker is able to inject a signal of the intended frequency into the output of the ADC. However, the output at both carrier frequencies has strong harmonics at $2f_{m},3f_{m},\ldots$\mathrm{Hz}, which indicates that the resulting signal is not pure. Moreover, there is a residual high-frequency component, which is attenuated as the carrier frequency $f_{c}$ increases. Finally, there is a frequency-dependent DC offset caused, in part, by the ESD diodes, while the peak-to-peak amplitude of the measured signal decreases as the carrier frequency increases. This is due to the low-pass filtering behavior of the sample-and-hold mechanism, which also explains why we are only able to demodulate signals for carrier frequencies until approximately $150\text{\,}\mathrm{MHz}$.

TLC549. The TLC549 (Figure 7(a)) also demodulates the injected signal, but still contains harmonics and a small high-frequency component.

AD7783. As the AD7783 (Figure 7(b)) only has a sampling frequency of $f_{s}=$19.79\text{,}\mathrm{Hz}, aliasing occurs when the baseband signal exceeds the Nyquist frequency $f_{s}/2$. For example, when the baseband frequency is $f_{m}=$10\text{\,}\mathrm{Hz}, the fundamental frequency dominating the measurements is of frequency $2f_{m}-f_{s}=20-19.79=$0.21\text{,}\mathrm{Hz}, with a high-frequency component of $f_{s}-f_{m}=$9.79\text{\,}\mathrm{Hz}.

AD7822, AD7276, Artix7. The three remaining ADCs contain strong high-frequency components which dominate the low-frequency signal. Their outputs appear to be AM-modulated, but at a carrier frequency which is below the ADC’s Nyquist frequency. However, with manual tuning of the carrier frequency, it is possible to remove this high frequency component, causing the ADC to demodulate the input. This is shown for the Flash ADC AD7822 in Figure 8, where we change the carrier frequency $f_{c}$ in steps of $100\text{\,}\mathrm{Hz}$.

Conclusion. The results of our experiments lead to the following observations:

Generality – All 6 ADCs tested are vulnerable to signal injections at multiple carrier frequencies, as they demodulate signals, matching the theoretical expectations of Section 2.1. As the ADCs are of all major types and with a range of different resolutions and sampling frequencies, the conclusions drawn should also be valid for other ADC chips. 2. 2.

Low-Pass Filter – Although all ADCs exhibited low-pass filtering characteristics, the maximum vulnerable carrier frequency for a given power level was multiple times the cut-off frequency of the $RC$ circuit at the input of the ADC. This extended the frequency range that an attacker could use for transmissions to attack the system. 3. 3.

Power – The adversary needs to select the power level of transmissions carefully: too much power in the input of the ADC can cause saturation and/or clipping of the measured signal. Too little power, on the other hand, results in output that looks like noise or a zero signal. 4. 4.

Carrier Frequency – Some ADCs were vulnerable at any carrier frequency that is not severely attenuated by the sample-and-hold mechanism. For others, high-frequency components dominated the intended baseband signal of frequency $f_{m}$ in the ADC output for most frequencies. Even then, carefully-chosen carrier frequencies resulted in a demodulated ADC output.

6 Discussion

We now discuss how our work can inform design choices. To start, choosing the right ADC directly impacts the susceptibility to signal injection attacks. As shown in Section 5, some ADCs distort the demodulated output and result in more sawtooth-like output, making them more resilient to clean sinusoidal injections. Moreover, other ADCs require fine-grained control over the carrier frequency of injection. As the adversarial signal is transformed through the circuit-specific transfer function $H_{C}$, the adversary may not have such control, resulting in a more secure system.

Having chosen the appropriate ADC based on cost, performance, security, or other considerations, a designer needs to assess the impact of $H_{C}$. Prior work has shown that even small layout or component changes affect the EMI behavior of a circuit [6, 13, 23]. Since the ADC behavior can be independently determined through direct power injections, fewer experiments with remote transmissions are required to evaluate the full circuit behavior and how changes in the circuit’s topology influence the system’s security.

Our selective security definition and algorithm address how to determine the vulnerability of a system against specific waveforms. Universal security, on the other hand, allows us to directly compare the security of two systems for a fixed adversarial voltage budget through their critical universal security thresholds. Moreover, given a probability/threshold $\epsilon$, we can calculate the critical universal voltage level, which is the maximum output level for which a system is still universally $\epsilon$-secure.

Our smartphone case study showed that our framework can be used in practice with real systems, while our “OK Google” experiments demonstrated that less-than-perfect injections of adversarial waveforms can have the same effect as perfect injections. This is because there is a mismatch between the true noise level of a system and the worst-case noise level that the system expects. In other words, injections worked at all carrier frequencies, even when the demodulated output was noisy or distorted. This is a deliberate, permissive design decision, which allows the adversary to succeed with a range of different and noisy waveforms $w(t)$, despite small amplitudes and DC offsets.

Although not heavily discussed in this paper, our model and definitions are general enough to capture alternative signal injection techniques. For instance, electro-mechanical sensors have resonant frequencies which allow acoustic injection attacks [22, 25]. $H_{C}$ can account for such imperfections in the sensors themselves, attenuating injection frequencies which are not close to the resonant frequencies. Our system model also makes it easy to evaluate countermeasures and defense mechanisms in its context. For example, shielding increases the attenuation factor of $H_{C}$, thereby increasing the power requirements for the adversary (Section 2.1). Alternatively, a low-pass filter (LPF) before the ADC and/or amplifier changes $H_{A}$, and attenuates the high-frequency components which would induce non-linearities. Note, however, that even moving the pre-amplifier, LPF and ADC into the same IC package does not fully eliminate the vulnerability to signal injection attacks (Section 7) as the channel between the analog sensor and the ADC cannot be fundamentally authenticated.

7 Related Work

Ever since a 2013 paper by Kune et al. showed that electromagnetic (EM) signals can be used to cause medical devices to deliver defibrillation shocks [10], there has been a rise in EM, acoustic, and optical signal injection attacks against sensor and actuator systems [7]. Although some papers have focused on vulnerabilities caused by the ADC sampling process itself [2], others have focused on exploiting the control algorithms that make use of the digitized signal. For example, Shoukry et al. showed how to force the Anti-Lock Braking Systems (ABS) to model the real input signal as a disturbance [20]. Selvaraj et al. also used the magnetic field to perform attacks on actuators, but further explored the relationship between frequency and the average injected voltage into ADCs [19]. By contrast, our paper primarily focused on a formal mathematical framework to understand security in the context of signal injection attacks, but also investigated the demodulation properties of different ADCs.

Our work further highlighted how to use the introduced algorithm and definitions to investigate the security of a smartphone, complementing earlier work which had shown that AM-modulated electromagnetic transmissions can be picked up by hands-free headsets to trigger voice commands in smartphones [9]. Voice injection attacks can also be achieved by modulating signals on ultrasound frequencies [27], or by playing two tones at different ultrasound frequencies and exploiting non-linearities in components [18]. Acoustic transmissions at a device’s resonant frequencies can also incapacitate [22] or precisely control [24] drones, with attackers who account for sampling rate drifts being able to control the outputs of accelerometers for longer periods of time [25]. Moreover, optical attacks can be used to spoof medical infusion pump measurements [14], and cause autonomous cars and unmanned aerial vehicles (UAVs) to drift or fail [3, 16, 26].

It should be noted that although the literature has primarily focused on signal injection attacks, some works have also proposed countermeasures. These defense mechanisms revolve around better sampling techniques, for example by adding unspoofable physical and computational delays [21], or by oversampling and selectively turning the sensors off using a secret sequence [28].

Overall, despite the extensive literature on signal injection attacks and defenses, the setup and effectiveness of different works is often reported in an inconsistent way, making their results hard to compare [7]. Our work, recognizing this gap, introduced a formal foundation to define and quantify security against signal injection attacks, working towards unifying the reporting methodology for competing works.

8 Conclusion

Sensors guide many of our choices, and we often blindly trust their values. However, it is possible to spoof their outputs through electromagnetic or other signal injection attacks. To address the lack of a unifying framework describing the susceptibility of devices to such attacks, we defined a system and adversary model for signal injections. Our model is the first to abstract away from specific environments and circuit designs and presents a strong adversary who is only limited by transmission power. It also makes it easy to discuss and evaluate countermeasures in its context and covers different types of signal injection attacks.

Within our model, we defined existential, selective, and universal security, capturing effects ranging from mere disruptions of the ADC outputs to precise injections of all waveforms. We showed that our definitions can be used to evaluate the security level of an off-the-shelf smartphone, and introduced an algorithm to calculate “critical” thresholds, which express how close an injected signal is to the ideal signal. Finally, we characterized the demodulation characteristics of commercial ADCs to malicious injections. In response to the emerging signal injection threat, our work paves the way towards a future where security can be quantified and compared through our methodology and security definitions.

Appendix 0.A Additional Experiments with ADCs

This appendix contains further measurements on the demodulation properties of ADCs. Section 0.A.1 precisely defines the similarity metric of Section 4, and validates the experimental setup. Section 0.A.2 and 0.A.3 then conduct further characterization experiments of the smartphone microphone and ATmega328P ADC respectively. Finally, Section 0.A.4 contains additional examples of the demodulation characteristics of the remaining ADCs.

0.A.1 Similarity Metric and Setup Validation

The experiments of Section 4.2 required an independent metric to evaluate how “similar” two signals are as a way of independently validating the security definitions of Section 3. The metric proposed for this task is based on the Pearson Correlation Coefficient (PCC), which is commonly found in signal-alignment and optimization applications [1, 11]. It is defined as the covariance of two variables divided by the product of their standard deviations:

[TABLE]

It is a suitable metric because it removes the mean value of the signals (DC shift), as well as the effects of scaling (related to transmission power). In other words, $\rho\left(X,aX+b\right)=1$ for a variable $X$ and scalars $a,b$. However, the PCC is sensitive to signal alignment. To overcome this issue, the phase (time) offset between two signals $s_{a}$, $s_{b}$ can be found using cross-correlation. Specifically, the signals are aligned when the cross-correlation coefficient is maximized:

[TABLE]

Using Equations (6) and (7), the similarity metric between the measured signal $\tilde{s}_{f}(t)$ and the ideal signal $w(t)$ can be defined as follows:

[TABLE]

To sanity-check this metric and the experimental setup, an unmodulated $20\text{\,}\mathrm{mV}$ $f_{m}=$1\text{,}\mathrm{kHz}$$ signal is generated. Figure 9(a) shows this waveform as measured by the smartphone of Section 4.2 along with an ideal $1\text{\,}\mathrm{kHz}$ signal. Even though the amplitudes are different, the frequency responses of the measured and the ideal signal are almost identical, with the two signals having a similarity of $0.9991$ according to Equation (8).

Figures 9(b) and 9(c) additionally show the same $f_{m}=$1\text{,}\mathrm{kHz} signal modulated on a carrier frequency of $f_{c}=$10\text{\,}\mathrm{kHz} at a depth of $\mu=1.0$. This carrier frequency was chosen as it is within the Nyquist range of the smartphone ADC (sampling frequency $f_{s}=$44.1\text{,}\mathrm{kHz}$$). Figure 9(b) contains measurements taken by a Rigol DS2302A oscilloscope with a timescale division of $500\text{\,}\mathrm{\SIUnitSymbolMicro s}$, while Figure 9(c) uses the smartphone microphone.

Unlike the examples of Section 4, the measurements shown in Figure 9 do not exhibit harmonics, but rather high-frequency components at $f_{c}$ and $f_{c}\pm f_{m}$, as expected. Consequently, the demodulation characteristics are due to non-linearities in amplifiers and ADCs when used outside of their intended range, instead of the experimental setup.

0.A.2 Smartphone Microphone Properties

This section characterizes the smartphone microphone through the direct injection methodology of Section 5. An $f_{m}=$1\text{,}\mathrm{kHz}$$ tone is amplitude-modulated with a depth of $\mu=1.0$ on the following carrier frequencies $f_{c}$: $25\text{\,}\mathrm{MHz}$, $50\text{\,}\mathrm{MHz}$, and $0.12.4\text{\,}\mathrm{GHz}$ at a step of $100\text{\,}\mathrm{MHz}$. The RMS output level $V_{RMS}^{Adv}=V_{PK}^{Adv}/\sqrt{2}$ of the signal generator is also varied between $0.20.9\text{\,}\mathrm{V}$ at a step of $100\text{\,}\mathrm{mV}$.

The similarity of the measured to the ideal signal for various carrier frequencies $f_{c}$ and output levels $V_{RMS}^{Adv}$ is shown in Figure 10(a). It is consistently high for all frequencies when 0.2\text{\,}\mathrm{V}$\leq V_{RMS}^{Adv}\leq$0.6\text{\,}\mathrm{V}, while higher voltage levels lead to more pronounced harmonics and clipping, reducing the similarity. The results are consistent across measurements: the $99\%$ confidence interval of the similarity is always below $\pm 0.0005$, except for the $(f_{c},V_{RMS}^{Adv})$ pairs $($300\text{,}\mathrm{MHz}$,$0.5\text{,}\mathrm{V}$)$ and $($2.4\text{,}\mathrm{GHz}$,$0.9\text{,}\mathrm{V}$)$, where it reaches $0.035$.

According to work on amplifier properties [23], the measured RMS voltage level $V_{RMS}$, the input voltage $V_{RMS}^{Adv}$, the modulation depth $\mu$, the signal frequency $f_{m}$, and the carrier frequency $f_{c}$ satisfy the following relationship:

[TABLE]

where $H_{2}$ is a second-order transfer function. Figure 10 mostly confirms this equation for the microphone and ADC subsystem of the smartphone.

Specifically, fixing $\mu$ and $f_{m}$ in Equation (9) suggests that $V_{RMS}^{V_{1}}/V_{RMS}^{V_{2}}=(V_{1}/V_{2})^{2}$ across all carrier frequencies $f_{c}$. Indeed, Figure 10(b) verifies that the received RMS voltage $V_{RMS}$ is linear in the modulation depth $\mu$ for fixed $V_{RMS}^{Adv}\in\{0.4,0.6\}$\mathrm{V}$$ with $R^{2}>0.97$. For $0.2\text{\,}\mathrm{V}$, the relationship becomes linear after $\mu\approx 0.8$, as the measured $V_{RMS}$ is approximately [math] below that.

Figure 10(c) illustrates that the transfer function for the $V_{RMS}$ response is frequency-dependent. Finally, Figure 10(d) shows $V_{RMS}$ relative to $V_{RMS}^{Adv}=$0.2\text{,}\mathrm{V}$. For$0.3\text{,}\mathrm{V}$\leq V_{RMS}\leq$0.6\text{,}\mathrm{V} and $f_{c}\geq$100\text{\,}\mathrm{MHz}, there is a linear relationship between the carrier frequency and V_{RMS}/V_{RMS}^{0.2\text{,}\mathrm{V}}, as predicted by Equation (9).

Figure 11 shows example microphone outputs for different carrier frequencies $f_{c}$ and output voltages $V_{RMS}^{Adv}$. They all exhibit high harmonics, but the similarity compared to the ideal signal for Figures 11(a)–11(c) is still over $0.9$. However, the injection of Figure 11(d) contains more pronounced distortions, and the similarity drops to less than $0.3$.

Overall, the results of this section show that a higher-order transfer function may be needed to more accurately predict the ADC output, both in terms of its RMS voltage, and in terms of the harmonics it produces.

0.A.3 ATmega328P Characterization

This section contains detailed results for injections into the ATmega328P ADC in three different arrangements: (a) the ADC on its own; (b) the ADC with an amplifier; and (c) the ADC with an amplifier and an antenna. The experimental results support the theoretical model of Section 2 and show that, despite its low-pass filtering behavior, the ADC demodulates signals carried at frequencies multiple times the cut-off frequency of the sample-and-hold mechanism. Moreover, external amplifier non-linearities increase the vulnerable frequency band into the $\mathrm{GHz}$ range.

ATmega328P Only. The first experiment targets the ATmega328P directly, without using any additional components. The similarity of the demodulated signal to the ideal signal is calculated for injections at different powers $P$, modulation depths $\mu$, carrier frequencies $f_{c}$, and a signal frequency of $f_{m}=$1\text{,}\mathrm{Hz}. As Figure [12(a)](#Pt0.A1.F12.sf1) illustrates, the similarity for $f_{c}=$1\text{\,}\mathrm{MHz} is always low due to aliasing. However, similarity is high for $f_{c}$ between $10150\text{\,}\mathrm{MHz}$, but signals are severely attenuated for $f_{c}\geq$300\text{,}\mathrm{MHz}$$. Small modulation depths and powers do not result in demodulated outputs, while too much power causes the ADC to be saturated. This leads to partial clipping of the signal, or induces a DC offset which is beyond the range of the ADC. Overall, the adversary has a range of choices for $P$ and $\mu$, and can use carrier frequencies which are multiple times the cutoff frequency of the ADC, provided these are not attenuated by the circuit-specific transfer function $H_{C}$.

ATmega328P + Amplifier. A low-cost, off-the-shelf wideband LNA is added before the input to the ADC to change the transfer function $H_{A}$. The amplifier works between $12000\text{\,}\mathrm{MHz}$ and can perform a maximum amplification of $32\text{\,}\mathrm{dB}$. It can output at most $10\text{\,}\mathrm{d}\mathrm{B}\mathrm{m}$, and has a noise figure of approximately $2\text{\,}\mathrm{dB}$. Sinusoidals of $f_{m}=$1\text{,}\mathrm{Hz} and $f_{m}=$10\text{\,}\mathrm{Hz} are modulated at depths of $\mu\in\{0.5,1.0\}$ on carrier frequencies $f_{c}$ from $100\text{\,}\mathrm{MHz}$ to $2.4\text{\,}\mathrm{GHz}$ at transmission powers $P$ between $-20\text{\,}\mathrm{d}\mathrm{B}\mathrm{m}$ and $10\text{\,}\mathrm{d}\mathrm{B}\mathrm{m}$. As can be seen in Figure 13(a), the similarity is high across all frequencies, provided the transmission power is above a minimum threshold.

The amplifier thus both reduces the power requirements for the adversary, and increases the vulnerable frequencies to the $\mathrm{GHz}$ range. This allows an attacker to target systems with short wires between the ADC and the sensor with a lower power budget: short wires are not a sufficient defense against electromagnetic out-of-band signal injection attacks. Moreover, it should be noted that an adversary gains an advantage by not obeying the amplifier constraints: abusing the amplifier by transmitting higher-powered signals or by driving frequency signals outside of the intended range still results in recognizable output. In other words, although the signal may be distorted, non-linearities produce outputs within the range of the ADC.

ATmega328P + Amplifier + Antenna. The final set of experiments changes the circuit-specific transfer function $H_{C}$ by using a transmitting antenna at the signal generator output and a receiving antenna at the amplifier input. The antennas used are Ettus Research omnidirectional VERT400 antennas, which are resonant at $144\text{\,}\mathrm{MHz}$, $400\text{\,}\mathrm{MHz}$, and $1.2\text{\,}\mathrm{GHz}$. The antennas are placed in parallel at a distance of $5\text{\,}\mathrm{cm}$ to one another, and the results for sine signals of $f_{m}=$1\text{,}\mathrm{Hz} and $f_{m}=$10\text{\,}\mathrm{Hz} are presented in Figure 13(b). Although the minimum power required for successful injections is higher due to transmission losses, the system remains vulnerable for all three frequencies due to the amplifier and ADC non-linearities. In other words, results are reproducible across multiple setups, whether through remote transmissions, or through direct injections with an identity transfer function $H_{C}(\sigma+j\omega)=\mathcal{L}\{\tilde{v}(t)\}/\mathcal{L}\{v(t)\}=1$.

Figures 14–16 show example outputs from the internal ATmega328P ADC for different carrier frequencies $f_{c}$, powers $P$, and modulation depths $\mu$, with $f_{m}$ fixed at $1\text{\,}\mathrm{Hz}$. Figure 14 first shows the results for the ADC on its own, and complements Figure 6 of Section 5. Although harmonics of the fundamental persist, the high-frequency component becomes less pronounced as $f_{c}$ increases.

Figure 15 then shows output from the ATmega328P for two different carrier frequencies $f_{c}$ when connected to an amplifier. The ADC no longer behaves like a low-pass filter due to non-linearities, while harmonics of the fundamental remain strong. Finally, Figure 16 shows output from the ATmega328P for remote injections using the VERT400 antenna with the amplifier. As in the amplifier case, carrier frequencies in the $\mathrm{GHz}$ range are still demodulated, and harmonics (and some high-frequency components) persist.

0.A.4 Further ADC Demodulation Examples

This section contains additional examples of injections into the different ADCs.

TLC549. Figure 17 shows example outputs from the TLC549 ADC for two carrier frequencies $f_{c}$. Harmonics of the fundamental are not pronounced, as the resolution is only 8 bits.

Artix 7. Figure 18 shows example outputs from the Artix 7 ADC for two carrier frequencies $f_{c}$. The output contains high-frequency components which dominate the target signal, forcing injections to require more fine-grained control over the carrier frequency.

AD7783. Figure 19 shows the output from the (slow) $\Delta\Sigma$ AD7783 ADC for different carrier frequencies and modulation depths. As $f_{m}=$10\text{,}\mathrm{Hz} is above the Nyquist frequency, aliasing occurs. The strongest frequency present is $2f_{m}-f_{s}=$0.21\text{\,}\mathrm{Hz}, while the high-frequency component is $f_{s}-f_{m}=$9.79\text{,}\mathrm{Hz}$$.

AD7822 & AD7276. Figure 20(a) and Figure 20(b) show example measurements for the AD7822 and the AD7276 ADCs respectively. As for the Artix 7, high-frequency components dominate the output, and hence require manual tuning to get a demodulated, low-frequency output.