USENIX Security Symposium 2015 Rocking Drones with Intentional Sound Noise on Gyroscopic Sensors 2015. 08. 14. Yunmok Son , Hocheol Shin, Dongkwan Kim, Youngseok Park, Juhwan Noh, Kibum Choi, Jungwoo Choi, and Yongdae Kim Electrical Engineering at KAIST System Security Lab.
Drones (Multi-coptors) Distribution delivery Search and rescue Aerial photography Private hobby 2
Drone, A New Threat Air terrorism using a weaponized drone 3
Drone, A New Threat Air terrorism using a weaponized drone Jul. 2015 3
Drone, A New Threat Air terrorism using a weaponized drone Jul. 2015 May. 2015 3
Drone, A New Threat Air terrorism using a weaponized drone Jul. 2015 May. 2015 Apr. 2015 3
Drone, A New Threat Air terrorism using a weaponized drone Jul. 2015 May. 2015 Apr. 2015 Sep. 2013 3
Attack Vectors of Drone Drone 4
Attack Vectors of Drone High Power Laser Bumper Drone Drone Physical Drone Capturing attack Drone with Net Shot-gun 4
Attack Vectors of Drone RF jamming or spoofing High Power Laser Comm. channel Bumper Drone Drone Physical Drone Capturing attack Drone with Net Shot-gun 4
Attack Vectors of Drone RF jamming Drone Hacking or spoofing High Power Laser Drone (“Skyjack”) Comm. Software channel hacking Bumper Drone Drone Physical Drone Capturing attack Drone with Net Shot-gun 4
Attack Vectors of Drone RF jamming Drone Hacking or spoofing High Power Laser Drone (“Skyjack”) Comm. Software channel hacking Bumper Drone Drone Physical Drone Capturing Positioning attack Drone with Net Shot-gun GPS Jamming or Spoofing 4
Attack Vectors of Drone RF jamming Drone Hacking or spoofing High Power Laser Drone (“Skyjack”) Comm. Software channel hacking Bumper Drone Drone Physical Drone Capturing Positioning attack Drone with Net Shot-gun Sensing channel GPS Jamming or Spoofing 4
Attack Vectors of Drone RF jamming Drone Hacking or spoofing High Power Laser Drone (“Skyjack”) Comm. Software channel hacking Bumper Drone How secure is drone against Drone Physical Drone Capturing Positioning attack Drone with Net interference on sensing channel? Shot-gun Sensing channel GPS Jamming or Spoofing 4
Drone System RF Wireless Wireless Transmitter Receiver Rotors User Flight (with speed Controller Controller controllers) 6
Drone System RF Wireless Wireless Transmitter Receiver Rotors User Flight (with speed Controller Controller controllers) 6
Drone System RF Wireless Wireless Transmitter Receiver Input Rotors User Flight (with speed Controller Controller controllers) 6
Drone System RF Wireless Wireless Transmitter Receiver Input Rotors User Flight (with speed Controller Controller controllers) Output 6
Drone System * IMU: Inertial Measurement Unit IMU RF Sensors Wireless Wireless (Gyroscope, Transmitter Receiver etc. Input Input Rotors User Flight (with speed Controller Controller controllers) Output 6
Gyroscope on Drone * MEMS: Micro-Electro-Mechanical Systems Inertial Measurement Unit (IMU) – A device to measure velocity, orientation, or rotation – Using a combination of MEMS gyroscopes and accelerometers 7
Gyroscope on Drone * MEMS: Micro-Electro-Mechanical Systems Inertial Measurement Unit (IMU) – A device to measure velocity, orientation, or rotation – Using a combination of MEMS gyroscopes and accelerometers MEMS gyroscope 7
Gyroscope on Drone * MEMS: Micro-Electro-Mechanical Systems Inertial Measurement Unit (IMU) <Conceptual structure of MEMS gyro.> – A device to measure velocity, orientation, or rotation – Using a combination of MEMS gyroscopes and accelerometers MEMS gyroscope 7
Gyroscope on Drone * MEMS: Micro-Electro-Mechanical Systems Inertial Measurement Unit (IMU) <Conceptual structure of MEMS gyro.> – A device to measure velocity, orientation, or rotation – Using a combination of MEMS gyroscopes and accelerometers MEMS gyroscope 7 (https://www.youtube.com/watch?v=joS6kfjuKQo, https://www.youtube.com/watch?t=45&v=sH7XSX10QkM)
Resonance in MEMS Gyroscope Mechanical resonance by sound noise – Known fact in the MEMS community – Degrades MEMS Gyro’s accuracy – With (resonant) frequencies of sound 8
Resonance in MEMS Gyroscope Mechanical resonance by sound noise – Known fact in the MEMS community – Degrades MEMS Gyro’s accuracy – With (resonant) frequencies of sound MEMS Gyro. with a high resonant frequency to reduce the sound noise effect (above 20kHz) 8
Experiment Setup Anechoic Up to 48 kHz Chamber without aliasing Sound Audio External Source Amplifier Soundcard (Speaker) USB Single Tone Sound Frequency: 10cm Up to 24 kHz Sound Noise every 100 Hz up to 30 without aliasing kHz USB Gyro- Arduino Laptop scope Read Registers Python Script 10
Sound Micro- source phone Sound Pressure Level = 85~95 dB (The sound level of Arduino Gyro- noisy factory or scope heavy truck)
12 EA 12 EA 12 EA On the target drones 15 kinds of MEMS gyroscopes 12
Experimental Results (1/3) Found the resonant frequencies of 7 MEMS gyroscopes Not found for 8 MEMS gyroscopes Supporting Resonant freq. Resonant freq. Sensor Vender Axis in the datasheet (axis) in our experiment (axis) L3G4200D STMicro. X, Y, Z 7,900 ~ 8,300 Hz (X, Y, Z) L3GD20 STMicro. X, Y, Z No detailed information 19,700 ~ 20,400Hz (X, Y, Z) LSM330 STMicro. X, Y, Z 19,900 ~ 20,000 Hz (X, Y, Z) MPU6000 InvenSense X, Y, Z 26,200 ~ 27,400 Hz (Z) 30 ~ 36 kHz (X) MPU6050 InvenSense X, Y, Z 27 ~ 33 kHz (Y) 25,800 ~ 27,700 Hz (Z) 24 ~ 30 kHz (Z) MPU9150 InvenSense X, Y, Z 27,400 ~ 28,600 Hz (Z) MPU6500 InvenSense X, Y, Z 25 ~ 29 kHz (X, Y, Z) 26,500 ~ 27,900 Hz (X, Y, Z) 13
Experimental Results (1/3) Found the resonant frequencies of 7 MEMS gyroscopes Not found for 8 MEMS gyroscopes Supporting Resonant freq. Resonant freq. Sensor Vender Axis in the datasheet (axis) in our experiment (axis) L3G4200D STMicro. X, Y, Z 7,900 ~ 8,300 Hz (X, Y, Z) L3GD20 STMicro. X, Y, Z No detailed information 19,700 ~ 20,400Hz (X, Y, Z) LSM330 STMicro. X, Y, Z 19,900 ~ 20,000 Hz (X, Y, Z) MPU6000 InvenSense X, Y, Z 26,200 ~ 27,400 Hz (Z) 30 ~ 36 kHz (X) MPU6050 InvenSense X, Y, Z 27 ~ 33 kHz (Y) 25,800 ~ 27,700 Hz (Z) 24 ~ 30 kHz (Z) MPU9150 InvenSense X, Y, Z 27,400 ~ 28,600 Hz (Z) MPU6500 InvenSense X, Y, Z 25 ~ 29 kHz (X, Y, Z) 26,500 ~ 27,900 Hz (X, Y, Z) 13
Experimental Results (1/3) Found the resonant frequencies of 7 MEMS gyroscopes Not found for 8 MEMS gyroscopes Supporting Resonant freq. Resonant freq. Sensor Vender Axis in the datasheet (axis) in our experiment (axis) L3G4200D STMicro. X, Y, Z 7,900 ~ 8,300 Hz (X, Y, Z) L3GD20 STMicro. X, Y, Z No detailed information 19,700 ~ 20,400Hz (X, Y, Z) LSM330 STMicro. X, Y, Z 19,900 ~ 20,000 Hz (X, Y, Z) MPU6000 InvenSense X, Y, Z 26,200 ~ 27,400 Hz (Z) 30 ~ 36 kHz (X) MPU6050 InvenSense X, Y, Z 27 ~ 33 kHz (Y) 25,800 ~ 27,700 Hz (Z) 24 ~ 30 kHz (Z) MPU9150 InvenSense X, Y, Z 27,400 ~ 28,600 Hz (Z) MPU6500 InvenSense X, Y, Z 25 ~ 29 kHz (X, Y, Z) 26,500 ~ 27,900 Hz (X, Y, Z) 13
Experimental Results (2/3) Unexpected output by sound noise (for L3G4200D) Standard deviation of raw data samples Standard deviation of raw data samples for 12 L3G4200D chips (X-axis) for 12 L3G4200D chips (Y-axis) 14
Experimental Results (2/3) Unexpected output by sound noise (for L3G4200D) Standard deviation of raw data samples Standard deviation of raw data samples for 12 L3G4200D chips (X-axis) for 12 L3G4200D chips (Y-axis) 7,900 ~ 8,300Hz 14
Experimental Results (2/3) Unexpected output by sound noise (for L3G4200D) Standard deviation of raw data samples Standard deviation of raw data samples for 12 L3G4200D chips (X-axis) for 12 L3G4200D chips (Y-axis) 7,900 ~ 8,300Hz 7,900 ~ 8,300Hz 14
Experimental Results (3/3) Unexpected output by sound noise (for L3G4200D) Raw data samples of one L3G4200D chip Standard deviation of raw data samples (@ 8,000Hz) for 12 L3G4200D chips (Z-axis) 15
Experimental Results (3/3) Unexpected output by sound noise (for L3G4200D) Raw data samples of one L3G4200D chip Standard deviation of raw data samples (@ 8,000Hz) for 12 L3G4200D chips (Z-axis) 7,900 ~ 8,300Hz 15
Experimental Results (3/3) Unexpected output by sound noise (for L3G4200D) Raw data samples of one L3G4200D chip Standard deviation of raw data samples (@ 8,000Hz) for 12 L3G4200D chips (Z-axis) 7,900 ~ 8,300Hz What is the impact of abnormal sensor output to the actuation of drone system? 15
Software Analysis Two open-source firmware programs – Multiwii project – ArduPilot project 16
Software Analysis Two open-source firmware programs – Multiwii project – ArduPilot project Rotor control algorithm 16
Software Analysis Two open-source firmware programs – Multiwii project – ArduPilot project Proportional-Integral -Derivative control Rotor control algorithm 16
Recommend
More recommend
