WP2: Security aware low power IoT Processor The 4th International Workshop on Cyber Security – Securing IoT Lightning talks Takatsugu Ono Kyushu University

Background and Motivation The key features of IoT system Many distributed devices Connected to the internet Low performance The devices can’t execute a rich attacking program One device is not a threat But, MANY devices can be a threat I think the key features of IoT are many distributed embedded devices, and the devices are connected. The performance of the device is low because a designer focus on reducing power and cost. So, the IoT devices can't execute a rich attacking program. It means one device is no threat, but attacker use many devices, it could be a threat.

Example: Smart Building IoT systems Air conditioner Internet Refrigerator Other systems TV etc. Let's think about smart building application There are some IoT systems in a house, and they are connected to the internet.

Example: Smart Building IoT systems Air conditioner Malware Internet Refrigerator Other systems TV Target etc. Here, the attacker tries to attack such as DDoS to the target. [C] Then, the attacker injects a malware into the IoT system, and highjack them. [C] The attacker performs the DDoS attack by using the highjacked devices. To make matters worse, there are many homes. So the attacker realizes strong DDoS attack exploiting the IoT systems. Attacker

Approach Threat detector Runtime energy-efficient monitoring Machine-learning based run-time program authentication Power attack detection, etc Runtime energy-efficient monitoring Low-cost, flexible monitoring Efficient power/energy management Virtual machine (VM) for IoT devices Low performance overhead, energy-efficient VM CPU/Memory architecture Architectural support for the VM and monitoring system To solv this problem, we will develop a threat detector, which can detect not authorized program such as malware.

Approach Threat detector Runtime energy-efficient monitoring Machine-learning based run-time program authentication Power attack detection, etc Runtime energy-efficient monitoring Low-cost, flexible monitoring Efficient power/energy management Virtual machine (VM) for IoT devices Low performance overhead, energy-efficient VM CPU/Memory architecture Architectural support for the VM and monitoring system The detector has features of authorized programs and is comparing the features during program execution. In this research, we will exploit machine learning based approach.

Approach Threat detector Runtime energy-efficient monitoring Machine-learning based run-time program authentication Power attack detection, etc Runtime energy-efficient monitoring Low-cost, flexible monitoring Efficient power/energy management Virtual machine (VM) for IoT devices Low performance overhead, energy-efficient VM CPU/Memory architecture Architectural support for the VM and monitoring system We need features of the program, so we monitor the behavior of the program. This mechanism should be low cost and energy efficient.

Approach Threat detector Runtime energy-efficient monitoring Machine-learning based run-time program authentication Power attack detection, etc Runtime energy-efficient monitoring Low-cost, flexible monitoring Efficient power/energy management Virtual machine (VM) for IoT devices Low performance overhead, energy-efficient VM CPU/Memory architecture Architectural support for the VM and monitoring system We believe that a VM for IoT devices can extract the behavior. The requirements are low performance overhead, and energy-efficient.

Approach Threat detector Runtime energy-efficient monitoring Machine-learning based run-time program authentication Power attack detection, etc Runtime energy-efficient monitoring Low-cost, flexible monitoring Efficient power/energy management Virtual machine (VM) for IoT devices Low performance overhead, energy-efficient VM CPU/Memory architecture Architectural support for the VM and monitoring system Also, CPU and Memory architecture should support the low overhead monitoring system. This system allows executing authorized programs.

Conclusions There will be many IoT devices One device is low performance, but attackers exploit the many devices We develop a threat detector Allow to execute only authorized program Collaboration Run-time energy-efficient monitoring IITD: Power, thermal monitoring KU: Program behavior CPU/Memory architecture IITD: Architectural support for light-weight VM KU: Architectural support for security and power/energy efficiency IoT devices are increasing. One device is low performance, but attackers exploit the many devices. So, we develop a threat detector, which allow to execute only authorized program. IITD and Kyushu University collaborate to develop the threat detector. At run-time energy-efficient monitoring area, IITD develops power and thermal monitoring system and Kyushu University analyzes the program behavior. And, at CPU/Memory architecture area, IITD supports light-weight VM and Kyushu University develops architectural supports for security and power/energy efficiency.

Thank you