Investigating Timing-Based Information Leakage in Data Flow-Driven Real-Time Systems

TL;DR

This paper demonstrates that in data flow-driven real-time systems, a low-priority observer task can infer the execution patterns of a high-priority critical task using statistical analysis of response times, revealing potential information leakage.

Contribution

We introduce a novel statistical analysis technique to infer critical execution patterns of high-priority tasks from low-priority task response times in real-time systems.

Findings

Higher precision in identifying critical invocations compared to random classification

Achieves low false positive rates (<25%) with minimal overhead

Demonstrated feasibility on UAV, manufacturing robot, and surveillance systems

Abstract

Leaking information about the execution behavior of critical real-time tasks may lead to serious consequences, including violations of temporal constraints and even severe failures. We study information leakage for a special class of real-time tasks that have two execution modes, namely, typical execution (which invokes the majority of times) and critical execution (to tackle exceptional conditions). The data flow-driven applications inherit such a multimode execution model. In this paper, we investigate whether a low-priority "observer" task can infer the execution patterns of a high-priority "victim" task (especially the critical executions). We develop a new statistical analysis technique and show that by analyzing the response times of the low-priority task, it becomes possible to extract the execution behavior of the high-priority task. We test our approach against a random selection technique that arbitrarily classifies a job as critical. We find that correlating the observer's response times with the victim's jobs can result in higher precision in identifying critical invocations compared to a random guess. We conduct extensive evaluations with systemically generated workloads, including a case study using a UAV autopilot (ArduPilot) taskset parameters. We found that our inference algorithm can achieve relatively low false positive rates (less than 25%) with relatively low footprint (1 MB memory and 50 ms timing overhead on a Raspberry Pi 4 platform). We further demonstrate the feasibility of inference on two cyber-physical platforms: an off-the-shelf manufacturing robot and a custom-built surveillance system.