jaseg/ihsm
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add back removed information since the page limit is less strict after all.

Browse source
This commit is contained in:
jaseg 2021-09-29 13:18:40 +02:00
parent a2ba8712e3
commit 65734fd7b5
2 changed files with 113 additions and 83 deletions
Download patch file Download diff file Expand all files Collapse all files

6
paper/diffinator.py
View file

@ -64,6 +64,12 @@ def generate_git_tex_diff(texfile, bibliography, revision):
def suppress_small_changes(match): def suppress_small_changes(match):
old, _1, new, _2 = match.groups() old, _1, new, _2 = match.groups()
if len(old) < 12 and len(new) < 12:
return new
if old.count(' ') < 3 and new.count(' ') < 3:
return new
new_chars = list(new) new_chars = list(new)
for char in old: for char in old:
if char not in string.ascii_letters: if char not in string.ascii_letters:

190
paper/ihsm_paper.tex
View file

@ -146,15 +146,16 @@ HSM continuously monitors itself whereas a physical seal only serves to record t
it. This examination can be done by eye in the field, but it can also be carried out in a laboratory using complex it. This examination can be done by eye in the field, but it can also be carried out in a laboratory using complex
equipment. An HSM in principle has to have this examination equipment built-in. equipment. An HSM in principle has to have this examination equipment built-in.
Physical seals are used in a wide variety of applications. Of interest for this paper are those used for monitoring of Physical seals are used in a wide variety of applications. The most interesting ones from a research point of view that
nuclear material under the International Atomic Energy Authority (IAEA). Most of these seals use the same approach that are recorded in public literature are those used for monitoring of nuclear material under the International Atomic
is used in Physically Unclonable Functions (PUFs), though their development predates that of PUFs by several decades. Energy Authority (IAEA). Most of these seals use the same approach that is used in Physically Unclonable Functions
The seal is created in a way that intentionally causes large, random device-to-device variations. These variations are (PUFs), though their development predates that of PUFs by several decades. The seal is created in a way that
precisely recorded at deployment. At the end of the seal's lifetime, the seal is returned to a lab and closely examined intentionally causes large, random device-to-device variations. These variations are precisely recorded at deployment.
to check for any deviations from the seal's prior recorded state. The type of variation used in these seals includes At the end of the seal's lifetime, the seal is returned to a lab and closely examined to check for any deviations from
random scratches in metal parts and random blobs of solder (IAEA metal cap seal), randomly cut optical fibers (COBRA the seal's prior recorded state. The type of variation used in these seals includes random scratches in metal parts and
seal), the uncontrollably random distribution of glitter particles in a polymer matrix (COBRA seal prototypes) as well random blobs of solder (IAEA metal cap seal), randomly cut optical fibers (COBRA seal), the uncontrollably random
as the precise three-dimensional surface structure of metal parts at microscopic scales (LMCV)~\cite{iaea2011}. distribution of glitter particles in a polymer matrix (COBRA seal prototypes) as well as the precise three-dimensional
surface structure of metal parts at microscopic scales (LMCV)~\cite{iaea2011}.
The IAEA's equipment portfolio does include electronic seals such as the EOSS. These devices are intended for remote The IAEA's equipment portfolio does include electronic seals such as the EOSS. These devices are intended for remote
reading, similar to an HSM. They are constructed from two components: A cable that is surveilled for tampering, and a reading, similar to an HSM. They are constructed from two components: A cable that is surveilled for tampering, and a
@ -186,10 +187,11 @@ protection even when powered off, similar to a smart card---but the design is no
In~\cite{tobisch2020}, Tobisch et al.\ describe a construction technique for a hardware security module that is based on In~\cite{tobisch2020}, Tobisch et al.\ describe a construction technique for a hardware security module that is based on
a WiFi transceiver inside a conductive enclosure. In their design, a reference signal is sent into the RF cavity formed a WiFi transceiver inside a conductive enclosure. In their design, a reference signal is sent into the RF cavity formed
by the conductive enclosure. The receiver(s) use the signal's reflections to characterize the phase and frequency by the conductive enclosure. One or more receivers listen for the signal's reflections and use them to characterize the
response of the RF cavity. They assume that the RF behavior of the cavity is inscrutable from the outside, and that any phase and frequency response of the RF cavity. The assumption underlying their system is that the RF behavior of the
small disturbances within the volume of the cavity will cause a significant change in its RF response. Based on cavity is inscrutable from the outside, and that any small disturbances within the volume of the cavity will cause a
commodity WiFi hardware, the resulting system is likely both much cheaper and capable of protecting a much larger significant change in its RF response. A core component of the work of Tobisch et al.~\cite{tobisch2020} is that they
use commodity WiFi hardware, so the resulting system is likely both much cheaper and capable of protecting a much larger
security envelope than designs using finely patterned foil security meshes such as~\cite{immler2019}, at the cost of security envelope than designs using finely patterned foil security meshes such as~\cite{immler2019}, at the cost of
worse and less predictable security guarantees. Where~\cite{tobisch2020} use electromagnetic radiation, Vrijaldenhoven worse and less predictable security guarantees. Where~\cite{tobisch2020} use electromagnetic radiation, Vrijaldenhoven
in~\cite{vrijaldenhoven2004} uses ultrasound waves traveling on a surface acoustic wave (SAW) device to a similar end. in~\cite{vrijaldenhoven2004} uses ultrasound waves traveling on a surface acoustic wave (SAW) device to a similar end.
@ -205,7 +207,10 @@ To the best of our knowledge, we are the first to propose a mechanically moving
security module. Most academic research concentrates on the issue of creating new, more sensitive security barriers for security module. Most academic research concentrates on the issue of creating new, more sensitive security barriers for
HSMs~\cite{immler2019} while commercial vendors concentrate on means to certify and cheaply manufacture these security HSMs~\cite{immler2019} while commercial vendors concentrate on means to certify and cheaply manufacture these security
barriers~\cite{drimer2008}. Our concept instead focuses on the issue of taking any existing, cheap low-performance barriers~\cite{drimer2008}. Our concept instead focuses on the issue of taking any existing, cheap low-performance
security barrier and transforming it into a marginally more expensive but high-performance one. security barrier and transforming it into a marginally more expensive but high-performance one. The closest to a
mechanical HSM that we were able to find during our research is an 1988 patent~\cite{rahman1988} that describes a
mechanism to detect tampering along a communication cable by enclosing the cable inside a conduit filled with
pressurized gas.
\section{Inertial HSM construction and operation} \section{Inertial HSM construction and operation}
\label{sec_ihsm_construction} \label{sec_ihsm_construction}
@ -252,13 +257,14 @@ challenging.
First, there are several ways how we can approach motion. Periodic, aperiodic and continuous motion could serve the First, there are several ways how we can approach motion. Periodic, aperiodic and continuous motion could serve the
purpose. There is also linear motion as well as rotation. We can also vary the degree of electronic control in this purpose. There is also linear motion as well as rotation. We can also vary the degree of electronic control in this
motion. The main constraint on the HSM's motion pattern is that it needs to be (almost) continuous to not expose any motion. The main constraint on the HSM's motion pattern is that it needs to be (almost) continuous to not expose any
weak spots. Additionally, it has to stay within a confined space: Linear motion would have to be periodic, like that of weak spots during instantaneous standstill of the HSM. Additionally, it has to stay within a confined space. For space
a pendulum. Such periodic linear motion will have to quickly reverse direction at its apex so the device is not efficiency, linear motion would have to be periodic, like that of a pendulum. Such periodic linear motion will have to
stationary long enough for this to become a weak spot. quickly reverse direction at its apex so the device is not stationary long enough for this to become a weak spot.
In contrast to linear motion, rotation is space-efficient and can be continuous if the axis of rotation is inside the In contrast to linear motion, rotation is space-efficient and can be continuous if the axis of rotation is inside the
device. When the axis is fixed, rotation will expose a weak spot close to the axis where tangential velocity is low. device. When the axis is fixed, rotation will expose a weak spot close to the axis where tangential velocity is low.
Possible mitigations are faster rotation to lessen the impact, additional tamper protection at the axis, and having the Faster rotation can lessen the security impact of this fact at the expense of power consumption and mechanical stress,
but it can never elimitate it. More effective mitigations are additional tamper protection at the axis, and having the
HSM perform a compound rotation that has no fixed axis. HSM perform a compound rotation that has no fixed axis.
High speed gives rise to large centrifugal acceleration, which poses the engineering challenge of preventing rapid High speed gives rise to large centrifugal acceleration, which poses the engineering challenge of preventing rapid
@ -286,33 +292,41 @@ using stochastic properties of the enclosure material to form a PUF, such academ
techniques to improve the system's security level by a significant margin. techniques to improve the system's security level by a significant margin.
In our research, we focus on security meshes as our IHSM's tamper sensors. The cost of advanced manufacturing In our research, we focus on security meshes as our IHSM's tamper sensors. The cost of advanced manufacturing
techniques and special materials used in commercial meshes poses an obstacle to small-scale manufacturing. The techniques and special materials used in fine commercial meshes poses an obstacle to small-scale manufacturing and
foundation of an IHSM security is that by moving the mesh, even a primitive, coarse mesh such as one made from a academic research. The foundation of an IHSM security is that by moving the mesh, even a primitive, coarse mesh such as
low-cost PCB becomes very hard to attack in practice. Additionally, the use of a mesh allows us to only spin the mesh one made from a low-cost PCB becomes very hard to attack in practice. This allows us to use a simple construction made
itself and its monitoring circuit and keep the payload inside the mesh stationary for reduced design complexity. up from low-cost components. Additionally, the use of a mesh allows us to only spin the mesh itself and its monitoring
Other tamper sensing systems such as RF fingerprinting would not allow for this degree of freedom in an IHSM. circuit and keep the payload inside the mesh stationary for reduced design complexity. Tamper sensing systems such as
RF fingerprinting that monitor the entire volume of the HSM instead of only a thin boundary layer would not allow for
this degree of freedom in an IHSM. They would instead require the entire IHSM to spin including its payload, which would
entail costly and complex systems for data and power transfer from the outside to the spinning payload.
\subsection{Braking detection} \subsection{Braking detection}
The security mesh is a critical component in the IHSM's defense against physical attacks, but its monitoring is only one The security mesh is a critical component in the IHSM's defense against physical attacks, but its monitoring is only one
half of this defense. The other half consists of a reliable and sensitive braking detection system. This system must be half of this defense. The other half consists of a reliable and sensitive braking detection system. This system must be
able to quickly detect any slowdown of the IHSM's rotation. able to quickly detect any slowdown of the IHSM's rotation. Ideally, a sufficiently sensitive sensor is able to measure
any external force applied to the IHSM's rotor and should already trigger a response at the first signs of a
manipulation attempt.
While the obvious choice to monitor rotation would be a magnetic or optical tachometer sensor attached to the IHSM's While the obvious choice to monitor rotation would be a magnetic or optical tachometer sensor attached to the IHSM's
shaft, this would be a poor choice for our purposes since optical and magnetic sensors are susceptible to contact-less shaft, this would be a poor choice for our purposes since optical and magnetic sensors are susceptible to contact-less
interference from outside. We could use feedback from the motor driver electronics to determine the speed, but this interference from outside. We could use feedback from the motor driver electronics to determine the speed. When using a
might allow for attacks at the mechanical interface between the mesh and the motor's shaft that decouple the mesh from BLDC motor, the driver electronics precisely know the rotor's position at all times. However, this apporach might allow
the motor. for attacks at the mechanical interface between the mesh and the motor's shaft. If an attacker can decouple the mesh
from the motor e.g.\ by drilling, laser ablation or electrical discharge machining (EDM) on the motor's shaft, the
motor could keep spinning at its nominal frequency while the mesh is already standing still.
Instead of a stator-side sensor, a rotor-side inertial sensor such as an accelerometer or gyroscope would be a good Instead of a stator-side sensor, a rotor-side inertial sensor such as an accelerometer or gyroscope placed inside the
component to serve as an IHSM's tamper sensor. A gyroscope would need to be placed close to the IHSM's shaft where spinning mesh monitoring circuit would be a good component to serve as an IHSM's tamper sensor. A gyroscope would need
centrifugal force is low, and would directly measure changes in angular velocity. An accelerometer could be placed to be placed close to the IHSM's shaft where centrifugal force is low, and would directly measure changes in angular
anywhere on the rotor and would measure centrifugal acceleration. velocity. An accelerometer could be placed anywhere on the rotor and would measure centrifugal acceleration.
Modern, fully integrated MEMS accelerometers are very precise. By comparing acceleration measurements against a model of Modern, fully integrated MEMS accelerometers are very precise. By comparing acceleration measurements against a model of
the device's mechanical motion, deviations can quickly be detected. This limits an attacker's ability to tamper with the the device's mechanical motion, deviations can quickly be detected. This limits an attacker's ability to tamper with the
device's motion. It may also allow remote monitoring of wear of the device's mechanical components such as device's motion. It may also allow remote monitoring of wear of the device's mechanical components such as bearings:
bearings~\cite{kvk2019,sh2016,adc2019,e2013}. MEMS accelerometers are fast enough to capture vibrations, which can be used as an early warning sign of failing
mechanical components~\cite{kvk2019,sh2016,adc2019,e2013}.
In a spinning IHSM, an accelerometer mounted at a known radius with its axis pointing radially will measure centrifugal In a spinning IHSM, an accelerometer mounted at a known radius with its axis pointing radially will measure centrifugal
acceleration. Centrifugal acceleration rises linearly with radius, and with the square of frequency: $a=\omega^2 r$. For acceleration. Centrifugal acceleration rises linearly with radius, and with the square of frequency: $a=\omega^2 r$. For
@ -326,9 +340,9 @@ applications.
To evaluate the feasibility of accelerometers as tamper sensors we can use a simple benchmark. Let us assume an IHSM To evaluate the feasibility of accelerometers as tamper sensors we can use a simple benchmark. Let us assume an IHSM
spinning at $\SI{1000}{rpm}$. To detect any attempt to brake it below $\SI{500}{rpm}$, we have to detect a difference in spinning at $\SI{1000}{rpm}$. To detect any attempt to brake it below $\SI{500}{rpm}$, we have to detect a difference in
acceleration of a factor of $\frac{\omega_2^2}{\omega_1^2}=4$. Even in case of sub-optimal placement, any commercial acceleration of a factor of $\frac{\omega_2^2}{\omega_1^2}=4$. Even without maximizing the accelerometer's dynamic range
MEMS accelerometer will provide this degree of dynamic range and accuracy. To detect slow deceleration drift through optimal placement, any commercial MEMS accelerometer will suffice. Only to detect slow deceleration, the
characteristics have to be taken into account. sensor's drift characteristics may have to be taken into account.
In Section~\ref{sec_accel_meas} below, we conduct an empirical evaluation of a commercial automotive high-$g$ MEMS In Section~\ref{sec_accel_meas} below, we conduct an empirical evaluation of a commercial automotive high-$g$ MEMS
accelerometer for braking detection in our prototype IHSM. accelerometer for braking detection in our prototype IHSM.
@ -339,8 +353,10 @@ With our IHSM's components taken care of, what remains to be decided is how to p
into a complete device. A basic spinning HSM might look as shown in Figure~\ref{fig_schema_one_axis}. Visible are the into a complete device. A basic spinning HSM might look as shown in Figure~\ref{fig_schema_one_axis}. Visible are the
axis of rotation, an accelerometer on the rotating part that is used to detect braking, the protected payload, and the axis of rotation, an accelerometer on the rotating part that is used to detect braking, the protected payload, and the
area covered by the rotating tamper detection mesh. Note that we only have to move the tamper protection mesh, not the area covered by the rotating tamper detection mesh. Note that we only have to move the tamper protection mesh, not the
entire contents of the HSM, keeping most of the HSM's mass stationary. In our proof-of-concept prototype, we accept a entire contents of the HSM, keeping most of the HSM's mass stationary. This reduces the moment of inertia of the
weak spot at the point where the shaft penetrates the mesh to simplify mechanical construction. rotating part. It also eliminates the need for rotating data and power connections to the payload, which can be
supplied through a hollow shaft instead. In our proof-of-concept prototype, we accept a weak spot at the point where the
shaft penetrates the mesh to simplify mechanical construction.
\begin{figure} \begin{figure}
\center \center
@ -443,21 +459,26 @@ if power outages of more than a few seconds are unlikely (e.g.\ because of an ex
be used as a flywheel for energy storage. be used as a flywheel for energy storage.
\paragraph{Spurious alarms due to vibration.} \paragraph{Spurious alarms due to vibration.}
Beyond the issues mentioned above, the effect of normal mechanical vibration on the IHSM's tamper sensors has to be
considered. During normal operation, IHSMs may receive vibration from outside sources such as backup generators, workers
bumping the IHSM and nearby traffic. Besides such everyday sources, (usually harmless) earthquakes are a common
occurrence in some regions of the world. None of these sources of vibration are likely to cause a false alarm, but
since IHSMs are rotating machines they will themselves cause some amount of vibration and thus vibration isolation is a
reasonable design requirement.
For reference, consider an IHSM running at an angular velcity of $\SI{1000}{rpm}$. A tamper
sensor mounted at a radius of $\SI{100}{\milli\meter}$ will measure a constant centrifugal Even with all components working to their specification, an IHSM could still catastrophically fail if for some reason
acceleration of approximately $100\,g$. its alarm would be spuriously activated due to movement of the device. The likelihood of such an alarm failure must be
Literature on car crashes shows that accelerations above $10\,g$ in the car's structural components minimized, e.g.\ by employing vibration damping. There are several possible causes why an IHSM might move during normal
correspond to a crash at $\SI{30}{\kilo\meter\per\hour}$ and above~\cite{ika2002,german2007}. Measurements of the Peak operation. The IHSM may have to be relocated between datacenters, or a worker may bump the IHSM. Additionally, the
Ground Acceleration (PGA) of severe earthquakes show that even the strongest earthquakes rarely reach a effect of normal mechanical vibration on the IHSM's tamper sensors has to be considered. During normal operation,
PGA of $\SI{0.1}{g}$~\cite{yoshimitsu1990} with the 2011 Tohoku earthquake at approximately vibration from outside sources such as backup generators and nearby traffic (e.g. trains) may couple into the IHSM
$\SI{0.3}{g}$. through the building. Since IHSMs are rotating machines they will themselves cause some amount of vibration and thus
vibration isolation is a reasonable design requirement. Besides everyday sources of mechanical noise, (usually
harmless) earthquakes are a common occurrence in some regions of the world and will couple through any reasonable amount
of vibration damping.
None of these sources of mechanical noise are likely to cause a false alarm. For reference, consider an IHSM running at
an angular velocity of $\SI{1000}{rpm}$. A tamper sensor mounted at a radius of $\SI{100}{\milli\meter}$ will measure a
constant centrifugal acceleration of approximately $100\,g$. Literature on car crashes shows that accelerations above
$10\,g$ in the car's structural components correspond to a crash at $\SI{30}{\kilo\meter\per\hour}$ and
above~\cite{ika2002,german2007}. Measurements of the Peak Ground Acceleration (PGA) of severe earthquakes show that
even the strongest earthquakes rarely reach a PGA of $\SI{0.1}{g}$~\cite{yoshimitsu1990} with the 2011 Tohoku earthquake
at approximately $\SI{0.3}{g}$.
Instantaneous acceleration increases linearly with frequency, but likewise simple vibration dampers work better with Instantaneous acceleration increases linearly with frequency, but likewise simple vibration dampers work better with
higher frequencies~\cite{kelly1993,beards1996,dixon2007}, To reduce the likelihood of false detections, it is enough to higher frequencies~\cite{kelly1993,beards1996,dixon2007}, To reduce the likelihood of false detections, it is enough to
@ -465,17 +486,18 @@ damp high-frequency shock and vibration, as low-frequency shock or vibration com
large enough to cause a false alarm. For instance, an earthquake's low-frequency vibrations dissipate a tremendous large enough to cause a false alarm. For instance, an earthquake's low-frequency vibrations dissipate a tremendous
amount of mechanical power across a large geographic area, but due to the their low absolute instantaneous acceleration, amount of mechanical power across a large geographic area, but due to the their low absolute instantaneous acceleration,
we can ignore them for the purposes of our tamper detection system. An IHSM's tamper detection subsystem will be able we can ignore them for the purposes of our tamper detection system. An IHSM's tamper detection subsystem will be able
to clearly distinguish attempts to stop the IHSM's rotation from normal environmental noise. Any external acceleration to clearly distinguish attempts to stop the IHSM's rotation from normal environmental noise by their magnitude. Any
that would come close in order of magnitude to the operating centrifugal acceleration at the periphery of an IHSM's external acceleration that would come close in order of magnitude to the operating centrifugal acceleration at the
rotor would likely destroy the IHSM. periphery of an IHSM's rotor would likely destroy the IHSM.
\subsection{Transportation} \subsection{Transportation}
While unintentional acceleration is unlikely to cause false alarms in an IHSM when simple vibration damping is employed, While unintentional acceleration is unlikely to cause false alarms in an IHSM when simple vibration damping is employed,
there is an issue when intentionally moving an IHSM: The IHSM's rotor stores significant rotational energy and will there is an issue when intentionally moving an IHSM: The IHSM's rotor stores significant rotational energy and will
respond to tipping with a precession force. This could become an issue when a larger IHSM is transported between e.g.\ respond to tipping with a precession force. This could become an issue when a larger IHSM is transported between e.g.\
the manufacturer's premises and its destination data center. The simple solution to this problem is to transport the IHSM the manufacturer's premises and its destination data center. The simple solution to this problem is to transport the
elastically mounted with its axis pointing upwards inside a heavy shipping box. IHSM elastically mounted with its axis pointing upwards inside a shipping box that is weighted to resist precession
forces.
During shipping, the IHSM will require a continuous power supply. Following our conservative estimate in During shipping, the IHSM will require a continuous power supply. Following our conservative estimate in
Section~\ref{sec-power-failure}, 48-hour courier shipping could easily be bridged with the equivalent of 5-10 laptop Section~\ref{sec-power-failure}, 48-hour courier shipping could easily be bridged with the equivalent of 5-10 laptop
@ -491,8 +513,8 @@ After outlining the basic mechanical design of an inertial HSM as well as the fu
above, in this section, we will detail possible ways to attack it. At the core of an IHSM's defenses is the same above, in this section, we will detail possible ways to attack it. At the core of an IHSM's defenses is the same
security mesh or other technology as it is used in traditional HSMs. This means that ultimately an attacker will have to security mesh or other technology as it is used in traditional HSMs. This means that ultimately an attacker will have to
perform the same steps they would have to perform to attack a traditional HSM. However, they will either need to perform the same steps they would have to perform to attack a traditional HSM. However, they will either need to
perform these attack steps with a tool that follows the HSM's rotation at high speed or they will first need to defeat perform these attack steps with a tool such as a CNC actuator or a laser that follows the HSM's rotation at high speed,
the braking sensor. or they will first need to defeat the braking sensor.
\subsection{Attacks that don't work} \subsection{Attacks that don't work}
@ -503,14 +525,13 @@ In principle, there are three ways to attack a conventional HSM. The hard way is
triggering the alarm, e.g.\ with a probe that is finer than the mesh's spacing. For larger probes, an attacker can triggering the alarm, e.g.\ with a probe that is finer than the mesh's spacing. For larger probes, an attacker can
laboriously uncover, then bridge the mesh traces to allow part of the mesh to be removed. Some HSMs attempt to detect laboriously uncover, then bridge the mesh traces to allow part of the mesh to be removed. Some HSMs attempt to detect
such attacks by measuring mesh resistance~\cite{obermaier2019}, but this is limited by available measurement precision. such attacks by measuring mesh resistance~\cite{obermaier2019}, but this is limited by available measurement precision.
If an attacker only wishes to disable a small section of the mesh to insert a handful of fine probes into the device,
% However, if an attacker only wishes to disable a small section of the mesh to insert a handful of fine probes into the this hardening approach becomes challenging. Consider a mesh that covers an area of $\SI{100}{\milli\meter}$ by
% device, this hardening approach becomes challenging. Consider a mesh that covers an area of $\SI{100}{\milli\meter}$ $\SI{100}{\milli\meter}$. An attacker who short-circuits a $\SI{5}{\milli\meter}$ by $\SI{5}{\milli\meter}$ section of
% by $\SI{100}{\milli\meter}$. An attacker who short-circuits a $\SI{5}{\milli\meter}$ by $\SI{5}{\milli\meter}$ section this mesh will change the mesh trace's resistance by approximately
% of this mesh will change the mesh trace's resistance by approximately $\frac{\SI{5}{\milli\meter}\cdot\SI{5}{\milli\meter}}{\SI{100}{\milli\meter}\cdot\SI{100}{\milli\meter}} = 0.25 \%$.
% $\frac{\SI{5}{\milli\meter}\cdot\SI{5}{\milli\meter}}{\SI{100}{\milli\meter}\cdot\SI{100}{\milli\meter}} = 0.25 \%$. Detecting this change would require a resistance measurement of at least $\SI{9}{bit}$ of precision and corresponding
% Detecting this change would require a resistance measurement of at least $\SI{9}{bit}$ of precision and corresponding temperature stability of the mesh material.
% temperature stability of the mesh material.
The second way to attack an HSM is to go \emph{around} the mesh. Many commercial HSMs sandwich the payload PCB between The second way to attack an HSM is to go \emph{around} the mesh. Many commercial HSMs sandwich the payload PCB between
two halves of an enclosure~\cite{obermaier2019}. This design is vulnerable to attempts to stick a fine needle through two halves of an enclosure~\cite{obermaier2019}. This design is vulnerable to attempts to stick a fine needle through
@ -587,27 +608,30 @@ $r=\SI{100}{\milli\meter}$. To keep a manipulator stationary within a $\SI{5}{\
window over a period of $\SI{10}{\second}$ requires attack tool and IHSM speeds to be matched to an accuracy better than window over a period of $\SI{10}{\second}$ requires attack tool and IHSM speeds to be matched to an accuracy better than
$\frac{\SI{5}{\milli\meter}}{\SI{10}{\second}} \cdot \frac{1}{2\pi r} = \SI{8.0}{\milli\hertz} = \SI{0.048}{rpm}$. $\frac{\SI{5}{\milli\meter}}{\SI{10}{\second}} \cdot \frac{1}{2\pi r} = \SI{8.0}{\milli\hertz} = \SI{0.048}{rpm}$.
Relative to a realistic IHSM's speed of $\SI{1000}{rpm}$ this corresponds to approximately $\SI{50}{ppm}$. Achieving Relative to a realistic IHSM's speed of $\SI{1000}{rpm}$ this corresponds to approximately $\SI{50}{ppm}$. Achieving
this accuracy would likely require active servo control of the attack tool's rotation. this accuracy would likely require active servo control of the attack tool's rotation that is locked, e.g.\ optically,
to the IHSM's rotor.
If an attacker were to solve the tracking issue, the remaining issue is that they still need to construct a manipulator If an attacker were to solve the tracking issue, the remaining issue is that they still need to construct a
tolerant to high g forces that is able to disable the IHSM's mesh. Simply drilling a small hole is not enough in this remote-controlled manipulator that is able to disable the IHSM's mesh. This manipulator would have to be tolerant to
case since the payload is stationary. Instead, using the rotating manipulator, the attacker has to create an opening in high g forces so that it can be mounted on the attack tool's rotating stage. Drilling only a small hole is not enough
the mesh large enough to place a \emph{stationary} probe on the payload. We estimate that creating a rotating, in this case since, while the mesh is moving, the payload is stationary. Instead, using the rotating manipulator, the
remote-controllable manipulator that can be used to successfully attack a security mesh is infeasible given the degree attacker has to create an opening in the mesh large enough to place a \emph{stationary} probe on the payload. We
of manual skill necessary even for normal soldering work. estimate that creating a rotating, remote-controllable manipulator that can be used to successfully attack a security
mesh is infeasible given the degree of manual skill necessary even for normal soldering work.
\subsection{Mechanical weak spots} \subsection{Mechanical weak spots}
As we elaborated in the previous paragraphs, we consider a fast-moving mesh to offer a strong tamper detection As we elaborated in the previous paragraphs, we consider a fast-moving mesh to offer a strong tamper detection
capability. However, depending on the type of motion used, the mesh's actual speed may vary by location and over time. capability based on the assumption that the mesh is moving too fast to tamper. However, depending on the type of motion
Our example configuration of a rotating mesh moves continuously and does not have any time-dependent weak spots. It used, the mesh's actual speed may vary by location and over time. Our example configuration of a rotating mesh moves
does, however, have a weak spot where the shaft penetrates the mesh at the axis. The mesh's tangential velocity continuously and does not have any time-dependent weak spots. It does, however, have a weak spot where the shaft
decreases close to the shaft, and the shaft itself may allow an attacker to insert tools such as probes into the device penetrates the mesh at the axis. The mesh's tangential velocity decreases close to the shaft, and the shaft itself may
through the opening it creates. Conventional HSMs also have to take precautions to protect their power and data allow an attacker to insert tools such as probes into the device through the opening it creates. Conventional HSMs also
connections, such as flat flex cables sandwiched in between security mesh foil layers~\cite{smith1998}. As a result of have to take precautions to protect their power and data connections. In conventional HSMs, power and data are routed
these precautions, in conventional HSMs this interface rarely is a mechanical weak spot. In inertial HSMs, careful into the enclosure along a meandering path through the PCB or through flat flex cables sandwiched in between security
engineering is necessary to achieve the same effect. Figure~\ref{shaft_cm} shows variations of the shaft interface with mesh foil layers~\cite{smith1998}. As a result of these precautions, in conventional HSMs this interface rarely is a
increasing complexity. mechanical weak spot. In inertial HSMs, careful engineering is necessary to achieve the same effect.
Figure~\ref{shaft_cm} shows variations of the shaft interface with increasing complexity.
\begin{figure} \begin{figure}
\begin{subfigure}[t]{0.3\textwidth} \begin{subfigure}[t]{0.3\textwidth}