Files

Abstract

Battery-powered embedded devices operate under energy constraints, and devices seek methods to manage their energy consumption. Adaptive algorithms are an emerging method to perform this management. Adaptive systems meet device constraints by leveraging data-dependent behavior to optimize the tradeoff between system quality (i.e., error) and energy. This data-dependent behavior comes from using the collected measurements to determine when to conserve resources. We demonstrate this design through a new adaptive system that performs recurrent neural network inference on embedded devices under energy constraints. This thesis argues that our analysis of embedded systems must go beyond this two-dimensional tradeoff space and explicitly consider data privacy as a third dimension because data-dependent behavior can leak crucial information about the captured measurements. We display this problem by presenting two new side-channel attacks and defenses. The first attack uses the communication volume of embedded devices employing adaptive sampling to learn about the captured data. The second attack exploits the exit decisions of adaptive, multi-exit neural networks to expose the model's results. In both settings, we develop defenses that eliminate information leakage and incur negligible overhead while achieving higher system quality (i.e., error) than non-adaptive algorithms. These properties make our security measures suitable under the resource constraints of embedded devices. These privacy issues extend beyond embedded systems and into the broader class of Internet-of-Things devices. We demonstrate this phenomenon by developing a new attack against Smart Televisions (TVs). Users enter information into Smart TVs through on-screen virtual keyboards, and popular Smart TV platforms, such as Apple's tvOS and Samsung's Tizen, make sounds as users type. We find that an attacker can use this audio as a side-channel to extract sensitive keystrokes (e.g., credit card details and common passwords) from Smart TVs. Samsung has acknowledged this vulnerability, and this attack highlights how modern Internet-connected devices can leak sensitive information in unintended ways.

Details

Actions

PDF

from
to
Export
Download Full History