Plug and Power: Fingerprinting USB Powered Peripherals via Power Side-channel

Riccardo Spolaor; Hao Liu; Federico Turrin; Mauro Conti; Xiuzhen  Cheng

doi:10.1109/INFOCOM53939.2023.10229048

Plug and Power: Fingerprinting USB Powered Peripherals via Power Side-channel

Riccardo Spolaor, Hao Liu, Federico Turrin, Mauro Conti, Xiuzhen Cheng

Cyber Security

Research output: Chapter in Book/Conference proceedings/Edited volume › Conference contribution › Scientific › peer-review

7 Downloads (Pure)

Abstract

The literature and the news regularly report cases of exploiting Universal Serial Bus (USB) devices as attack tools for malware injections and private data exfiltration. To protect against such attacks, security researchers proposed different solutions to verify the identity of a USB device via side-channel information (e.g., timing or electromagnetic emission). However, such solutions often make strong assumptions on the measurement (e.g., electromagnetic interference-free area around the device), on a device’s state (e.g., only at the boot or during specific actions), or are limited to one particular type of USB device (e.g., flash drive or input devices).In this paper, we present PowerID, a novel method to fingerprint USB peripherals based on their power consumption. PowerID analyzes the power traces from a peripheral to infer its identity and properties. We evaluate the effectiveness of our method on an extensive power trace dataset collected from 82 USB peripherals, including 35 models and 8 types. Our experimental results show that PowerID accurately recognizes a peripheral type, model, activity, and identity.

Original language	English
Title of host publication	Proceedings of the INFOCOM 2023 - IEEE International Conference on Computer Communications
Place of Publication	Danvers
Publisher	IEEE
Number of pages	10
ISBN (Electronic)	979-8-3503-3414-2
ISBN (Print)	979-8-3503-3415-9
DOIs	https://doi.org/10.1109/INFOCOM53939.2023.10229048
Publication status	Published - 2023
Event	IEEE INFOCOM 2023 - IEEE Conference on Computer Communications - New York City, United States Duration: 17 May 2023 → 20 May 2023

Conference

Conference	IEEE INFOCOM 2023 - IEEE Conference on Computer Communications
Country/Territory	United States
City	New York City
Period	17/05/23 → 20/05/23

Bibliographical note

Green Open Access added to TU Delft Institutional Repository 'You share, we take care!' - Taverne project https://www.openaccess.nl/en/you-share-we-take-care
Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public.

Keywords

USB Security
Power Side-Channel
USB peripherals
Hardware fingerprinting

Access to Document

10.1109/INFOCOM53939.2023.10229048

Plug_and_Power_Fingerprinting_USB_Powered_Peripherals_via_Power_Side-channelFinal published version, 1.74 MB

Cite this

@inproceedings{422b1ea4f64e421baacbe85c819b2061,

title = "Plug and Power: Fingerprinting USB Powered Peripherals via Power Side-channel",

abstract = "The literature and the news regularly report cases of exploiting Universal Serial Bus (USB) devices as attack tools for malware injections and private data exfiltration. To protect against such attacks, security researchers proposed different solutions to verify the identity of a USB device via side-channel information (e.g., timing or electromagnetic emission). However, such solutions often make strong assumptions on the measurement (e.g., electromagnetic interference-free area around the device), on a device{\textquoteright}s state (e.g., only at the boot or during specific actions), or are limited to one particular type of USB device (e.g., flash drive or input devices).In this paper, we present PowerID, a novel method to fingerprint USB peripherals based on their power consumption. PowerID analyzes the power traces from a peripheral to infer its identity and properties. We evaluate the effectiveness of our method on an extensive power trace dataset collected from 82 USB peripherals, including 35 models and 8 types. Our experimental results show that PowerID accurately recognizes a peripheral type, model, activity, and identity.",

keywords = "USB Security, Power Side-Channel, USB peripherals, Hardware fingerprinting",

author = "Riccardo Spolaor and Hao Liu and Federico Turrin and Mauro Conti and Xiuzhen Cheng",

note = "Green Open Access added to TU Delft Institutional Repository 'You share, we take care!' - Taverne project https://www.openaccess.nl/en/you-share-we-take-care Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public.; IEEE INFOCOM 2023 - IEEE Conference on Computer Communications ; Conference date: 17-05-2023 Through 20-05-2023",

year = "2023",

doi = "10.1109/INFOCOM53939.2023.10229048",

language = "English",

isbn = "979-8-3503-3415-9",

booktitle = "Proceedings of the INFOCOM 2023 - IEEE International Conference on Computer Communications",

publisher = "IEEE",

address = "United States",

}

Spolaor, R, Liu, H, Turrin, F, Conti, M & Cheng, X 2023, Plug and Power: Fingerprinting USB Powered Peripherals via Power Side-channel. in Proceedings of the INFOCOM 2023 - IEEE International Conference on Computer Communications. IEEE, Danvers, IEEE INFOCOM 2023 - IEEE Conference on Computer Communications, New York City, United States, 17/05/23. https://doi.org/10.1109/INFOCOM53939.2023.10229048

Plug and Power: Fingerprinting USB Powered Peripherals via Power Side-channel. / Spolaor, Riccardo; Liu, Hao; Turrin, Federico et al.
Proceedings of the INFOCOM 2023 - IEEE International Conference on Computer Communications. Danvers: IEEE, 2023.

Research output: Chapter in Book/Conference proceedings/Edited volume › Conference contribution › Scientific › peer-review

TY - GEN

T1 - Plug and Power

T2 - IEEE INFOCOM 2023 - IEEE Conference on Computer Communications

AU - Spolaor, Riccardo

AU - Liu, Hao

AU - Turrin, Federico

AU - Conti, Mauro

AU - Cheng, Xiuzhen

N1 - Green Open Access added to TU Delft Institutional Repository 'You share, we take care!' - Taverne project https://www.openaccess.nl/en/you-share-we-take-care Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public.

PY - 2023

Y1 - 2023

N2 - The literature and the news regularly report cases of exploiting Universal Serial Bus (USB) devices as attack tools for malware injections and private data exfiltration. To protect against such attacks, security researchers proposed different solutions to verify the identity of a USB device via side-channel information (e.g., timing or electromagnetic emission). However, such solutions often make strong assumptions on the measurement (e.g., electromagnetic interference-free area around the device), on a device’s state (e.g., only at the boot or during specific actions), or are limited to one particular type of USB device (e.g., flash drive or input devices).In this paper, we present PowerID, a novel method to fingerprint USB peripherals based on their power consumption. PowerID analyzes the power traces from a peripheral to infer its identity and properties. We evaluate the effectiveness of our method on an extensive power trace dataset collected from 82 USB peripherals, including 35 models and 8 types. Our experimental results show that PowerID accurately recognizes a peripheral type, model, activity, and identity.

AB - The literature and the news regularly report cases of exploiting Universal Serial Bus (USB) devices as attack tools for malware injections and private data exfiltration. To protect against such attacks, security researchers proposed different solutions to verify the identity of a USB device via side-channel information (e.g., timing or electromagnetic emission). However, such solutions often make strong assumptions on the measurement (e.g., electromagnetic interference-free area around the device), on a device’s state (e.g., only at the boot or during specific actions), or are limited to one particular type of USB device (e.g., flash drive or input devices).In this paper, we present PowerID, a novel method to fingerprint USB peripherals based on their power consumption. PowerID analyzes the power traces from a peripheral to infer its identity and properties. We evaluate the effectiveness of our method on an extensive power trace dataset collected from 82 USB peripherals, including 35 models and 8 types. Our experimental results show that PowerID accurately recognizes a peripheral type, model, activity, and identity.

KW - USB Security

KW - Power Side-Channel

KW - USB peripherals

KW - Hardware fingerprinting

UR - http://www.scopus.com/inward/record.url?scp=85171626735&partnerID=8YFLogxK

U2 - 10.1109/INFOCOM53939.2023.10229048

DO - 10.1109/INFOCOM53939.2023.10229048

M3 - Conference contribution

SN - 979-8-3503-3415-9

BT - Proceedings of the INFOCOM 2023 - IEEE International Conference on Computer Communications

PB - IEEE

CY - Danvers

Y2 - 17 May 2023 through 20 May 2023

ER -

Plug and Power: Fingerprinting USB Powered Peripherals via Power Side-channel

Abstract

Conference

Bibliographical note

Keywords

Access to Document

Other files and links

Fingerprint

Cite this