Ripple: Software−Only Detection of Signal Injection Attacks in Drone Temperature Sensors

Abstract

Signal Injection attacks pose a serious threat to systems that rely on sensor information to determine their behaviour. Using such an attack, an attacker can remotely manipulate the values of a sensor by transmitting appropriately formed RF signals that induce a current in the sensor wires. For example, to manipulate the temperature sensor in a battery management system, to trigger thermal protection and shut down the battery. While a number of defence mechanisms have been proposed, they all need additional hardware to work. In this paper, we present RIPPLE, a fully software-based detection mechanism that can reliably detect signal injection attacks against sensor systems in drones. A software-only solution is a practical way to add protection to an existing fleet of drones, and it is a cost effective alternative to the existing proposals for new drones. Our detection mechanism exploits a physical layer property known as small-scale (fast) fading, which causes the wireless channel between the attacker and drone to change unpredictably. As a result, the power induced by the attacker's transmission will oscillate rapidly, whenever the drone is in motion. We show for the first time that this effect occurs even with extremely minimal motion, such as a drone hovering in place on a calm, windless day. This oscillation is used as the basis of our detection system. We conduct an in-depth evaluation of RIPPLE on drones in several different environments. Our results show that RIPPLE reliably detects signal injection attacks. Even for weak attacks, changing the temperature by as little as 2°C, and with a drone movement of only a few millimeters, we have a success rate of over 98%. The performance only improves with stronger attack signals or more movement.