1. Information Security of Embedded Systems 20.1.2010: Communication, wireless remote access Prof. Dr. Holger Schlingloff Institut für Informatik und Fraunhofer FIRST

2. 20.1.2010Embedded Security © Prof. Dr. H. Schlingloff 20102 Structure 1. Introductory example 2. Embedded systems engineering 1.definitions and terms 2.design principles 3. Foundations of security 1.threats, attacks, measures 2.construction of safe systems 4. Design of secure systems 1.design challenges 2.safety modelling and assessment 3.cryptographic algorithms 5. Communication of embedded systems 1.remote access 2.sensor networks 6. Algorithms and measures 1.digital signatures 2.key management 3.authentification 4.authorization 7. Formal methods for security 1.protocol verification 2.logics and proof methods

3. 20.1.2010Embedded Security © Prof. Dr. H. Schlingloff 20103 Communication of Embedded Systems Various wired and wireless bus systems are being used  CAN, LIN, MOST, I2C, …  GSM, UMTS, …  WiFi, Bluetooth, … Security considerations  general rule: newer standards are more secure  known problems with nearly all standards

4. 20.1.2010Embedded Security © Prof. Dr. H. Schlingloff 20104 Wireless Communication Mobile telephony  A-net 1926, B-net 1974, C-net 1985 (small cells)  D-net 1992 (GSM), E-net 1993 (GSM1800)  GPRS, EDGE (packets)  UMTS 2004 (3G), HSDPA 2006 Wireless data transmission  WiFi IEEE 802.11 1997  IrDA 1993  Bluetooth 1999  WiMAX IEEE 802.16  ZigBee (low power), Wibree (bluetooth low power)  Z-Wave (home automation)  NFC (e-cash)  …

5. 20.1.2010Embedded Security © Prof. Dr. H. Schlingloff 20105 GSM Threats Unauthorized use of network  masquerading, wrong/insufficient authentication Eavesdropping of communication  catching and decoding radio waves Spoofing, faking, modifying messages  man-in-the-middle attacks Privacy compromising, locating, tracking Theft and robbery Network flooding, denial of service Tampering with devices

6. 20.1.2010Embedded Security © Prof. Dr. H. Schlingloff 20106 GSM Security Mechanisms SIM-card  IMSI: International Mobile Subscriber Identity  128-bit user authentication key, PIN, PUK  MSISDN: mobile station calling number  session key  TMSI: temporary MSI, for each session, on SIM  LAI: location area indicator Further data  IMEI: int. mobile equipment identification Secure identification of subscriber to network Encrypted communication via session key

7. 20.1.2010Embedded Security © Prof. Dr. H. Schlingloff 20107 GSM Security Issues SIM information open  SIM-card reader, cloning, fake SIM cards One-sided authentication (mobile  base station)  fake base station for spoofing (“IMSI-Catcher”) 64-bit (weak) encryption  session key is used for several days  weak key generation algorithm (COMP-128)  weak encryption algorithm (A5 stream cypher) No data integrity SMS not intended for secure communication Mobility tracking

8. 20.1.2010Embedded Security © Prof. Dr. H. Schlingloff 20108

9. 20.1.2010Embedded Security © Prof. Dr. H. Schlingloff 20109 GSM vs. UMTS Security more consideration in design USIM replaces SIM cipher algorithms published 128 bit instead of 64/40 bit frequent key exchange, no transient keys authentication of base station data integrity mechanisms exchangeable algorithms extensibility to other radio links user identity confidentiality, user untraceability

10. 20.1.2010Embedded Security © Prof. Dr. H. Schlingloff 201010 UMTS Security Architecture Build on GSM Multi-layer concept A) network access security provides users with secure access to UMTS services and protect against attacks on the radio access link B) network domain security protects against attacks on the wireline network and allows nodes in the provider domain to exchange signalling data securely C) user domain security provides secure access to mobile stations D) application domain security allows the secure exchange of messages between applications in the user and in the provider domain E) visibility and configurability of security http://ntrg.cs.tcd.ie/undergrad/4ba2.05/group7/index.html

11. 20.1.2010Embedded Security © Prof. Dr. H. Schlingloff 201011 UMTS Authentication and Key Agreement AKA – Challenge-Response-Verfahren AuC – authorization centre of home environment (HE) USIM – UMTS SIM  IMSI – permanent identity  secret AES-key agreement with AC  after first contact a TMSI/LAI is issued by HE; generation of AV (authorization vector, 5 keys) for PLMN  login to serving network (SN) via challenge-response; SN contacts HE for correct keys  agreement on encryption via AES (recommended) UMTS AKA problems in interoperability with GSM

12. 20.1.2010Embedded Security © Prof. Dr. H. Schlingloff 201012

13. 20.1.2010Embedded Security © Prof. Dr. H. Schlingloff 201013 Further Information Recommended reading: Boman, Horn, Howard, Niemi: UMTS security ELECTRONICS & COMMUNICATION ENGINEERING JOURNAL, Oct. 2002 http://www.it.iitb.ac.in/~kavita/GSM_Security_Papers/New%20papers/umts_security.pdf http://www.tkn.tu-berlin.de/curricula/ws0405/vl-umts/UMTS%20Security%20IEE.pdf http://www.it.iitb.ac.in/~kavita/GSM_Security_Papers/New%20papers/umts_security.pdf http://www.tkn.tu-berlin.de/curricula/ws0405/vl-umts/UMTS%20Security%20IEE.pdf Non-Recommended reading: http://www.3gpp.org/specifications